A vulnerability in the Linux kernel scheduler's handling of runqueue locks exposes local users to potential privilege escalation and system denial of service.

This is a race condition vulnerability within the scheduler core (sched/core). It occurs because the pick_next_task() function fails to safely handle instances where a pick_task() implementation releases the runqueue (rq) lock, allowing an interleaving selection to invalidate the current state and potentially causing improper task execution or memory corruption.

A successful exploit requires local access, but the impact is significant due to the potential for kernel-level code execution. With a CVSS score of 7.3, this high-severity flaw could allow an attacker to escalate privileges from a standard user to root, bypass security controls, or crash the system, resulting in severe data compromise or prolonged operational downtime.

Immediate Action: Apply the kernel patch provided by the Linux stable maintainers by updating the system to Linux kernel version 7.2.4 or later.

Proactive Monitoring: Monitor system logs for kernel panic events or repeated scheduler-related errors, which may indicate an exploitation attempt.

Compensating Controls: Restrict access to the server to only authorized personnel to prevent the local access required for exploitation, and utilize kernel-level auditing tools to detect unusual privilege transitions.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of kernel-level vulnerabilities, administrators should prioritize updating affected systems to the patched kernel version 7.2.4 as part of the next maintenance cycle. Although local access is required, the severity of potential root-level access necessitates swift remediation to maintain the integrity of the host environment.