---
title: "CVE-2026-89521: CVE-2026-89521"
description: "In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle pick_task() releasing the rq lock Core scheduling's pick_next_task() breaks when a ->pick_task() implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held continuously. Once a pick can drop the lock, an interleaving selection can invalidate all of it: the single-CPU fast path can commit an uncookied pick although the core went cookied during the release, and forceidle committed by the interleaving selection skews the restarted pass's accounting. Fix it by restarting the whole selection when a pick returns RETRY_TASK after releasing the lock: a single restart point above the state derivation replaces the per-loop restart labels, so a retry picks up state committed by interleaving selections and accounts and resets forceidle like a fresh selection would. need_sync and fi_before latch across retries. Clock validity can't be re-derived - there is no program-ordered way to tell whether the own and core rq clocks are still updated after the lock was released, as other lockers' pin cycles may or may not have invalidated them. When restarting, clear core_clock_updated so that the sibling loop re-updates the core rq, and update the own rq clock if invalidated."
url: https://panop.io/threat-heartbeat/CVE-2026-89521/
---

# CVE-2026-89521 CVE-2026-89521

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle pick\_task() releasing the rq lock Core scheduling's pick\_next\_task() breaks when a ->pick\_task() implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held continuously. Once a pick can drop the lock, an interleaving selection can invalidate all of it: the single-CPU fast path can commit an uncookied pick although the core went cookied during the release, and forceidle committed by the interleaving selection skews the restarted pass's accounting. Fix it by restarting the whole selection when a pick returns RETRY\_TASK after releasing the lock: a single restart point above the state derivation replaces the per-loop restart labels, so a retry picks up state committed by interleaving selections and accounts and resets forceidle like a fresh selection would. need\_sync and fi\_before latch across retries. Clock validity can't be re-derived - there is no program-ordered way to tell whether the own and core rq clocks are still updated after the lock was released, as other lockers' pin cycles may or may not have invalidated them. When restarting, clear core\_clock\_updated so that the sibling loop re-updates the core rq, and update the own rq clock if invalidated.

CVSS base score 7.3 /10

High

CISA KEV

Not listed

Public exploit

None known

EPSS

0.15% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-89521)

## Details

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Published

11 September 2026

Updated

15 October 2026

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-89521](https://nvd.nist.gov/vuln/detail/CVE-2026-89521)
- [https://git.kernel.org/stable/c/88ed5a66467ca2a5148b9997af9c71d8c43060ad](https://git.kernel.org/stable/c/88ed5a66467ca2a5148b9997af9c71d8c43060ad)
- [https://git.kernel.org/stable/c/c10b216a072ff5c57bc880a05f87eb519aecc529](https://git.kernel.org/stable/c/c10b216a072ff5c57bc880a05f87eb519aecc529)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)