CVE-2026-74593: sched_ext: Take cgroup_lock() first in scx_cgroup_lock()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Take cgroup_lock() first in scx_cgroup_lock()

scx_cgroup_lock() write-locks scx_cgroup_ops_rwsem and then takes
cgroup_lock(), which can deadlock through kernfs:

  scx enable/disable         cgroup rmdir           cpu.weight write
  ------------------         ------------           ----------------
                             cgroup_lock()
  percpu_down_write(rwsem)
  cgroup_lock()
                                                    kernfs_get_active()
                                                    percpu_down_read(rwsem)
                             kernfs_drain()

The enable path waits for the rmdir to release cgroup_mutex. The rmdir,
deactivating the cpu controller's files, waits in kernfs_drain() for the
write's active reference. The write, in scx_group_set_weight(), waits for
the rwsem behind the pending writer.

Take cgroup_lock() first. The set_* paths take no cgroup locks inside the
read side, so a pending write-lock then only waits for read sections that
always run to completion, and no dependency from the rwsem back to
cgroup_mutex remains.

The Linux kernel CVE team has assigned CVE-2026-74593 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.18 with commit a5bd6ba30b3364354269b81ac55c2edca9a96d6d and fixed in 7.1.9 with commit a054c9ffa9b7a0dffb763837b91ac9d381ec6d10
	Issue introduced in 6.18 with commit a5bd6ba30b3364354269b81ac55c2edca9a96d6d and fixed in 7.2 with commit 5f8b69642d18e1f3e11996707842ac530444e959

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74593
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/sched/ext/ext.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a054c9ffa9b7a0dffb763837b91ac9d381ec6d10
	https://git.kernel.org/stable/c/5f8b69642d18e1f3e11996707842ac530444e959