{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "237c43037b336e36a49eb9f2daac1c7719ec7f8b",
              "status": "affected",
              "version": "18853ba782bef65fc81ef2b3370382e5b479c5eb",
              "versionType": "git"
            },
            {
              "lessThan": "e14fd98c6d66cb76694b12c05768e4f9e8c95664",
              "status": "affected",
              "version": "18853ba782bef65fc81ef2b3370382e5b479c5eb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/ext: Prevent update_locked_rq() calls with NULL rq\n\nAvoid invoking update_locked_rq() when the runqueue (rq) pointer is NULL\nin the SCX_CALL_OP and SCX_CALL_OP_RET macros.\n\nPreviously, calling update_locked_rq(NULL) with preemption enabled could\ntrigger the following warning:\n\n    BUG: using __this_cpu_write() in preemptible [00000000]\n\nThis happens because __this_cpu_write() is unsafe to use in preemptible\ncontext.\n\nrq is NULL when an ops invoked from an unlocked context. In such cases, we\ndon\u0027t need to store any rq, since the value should already be NULL\n(unlocked). Ensure that update_locked_rq() is only called when rq is\nnon-NULL, preventing calling __this_cpu_write() on preemptible context."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-16T11:12:11.304Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/237c43037b336e36a49eb9f2daac1c7719ec7f8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e14fd98c6d66cb76694b12c05768e4f9e8c95664"
        }
      ],
      "title": "sched/ext: Prevent update_locked_rq() calls with NULL rq",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38522",
    "datePublished": "2025-08-16T11:12:11.304Z",
    "dateReserved": "2025-04-16T04:51:24.023Z",
    "dateUpdated": "2025-08-16T11:12:11.304Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38522\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-16T12:15:27.523\",\"lastModified\":\"2025-08-16T12:15:27.523\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched/ext: Prevent update_locked_rq() calls with NULL rq\\n\\nAvoid invoking update_locked_rq() when the runqueue (rq) pointer is NULL\\nin the SCX_CALL_OP and SCX_CALL_OP_RET macros.\\n\\nPreviously, calling update_locked_rq(NULL) with preemption enabled could\\ntrigger the following warning:\\n\\n    BUG: using __this_cpu_write() in preemptible [00000000]\\n\\nThis happens because __this_cpu_write() is unsafe to use in preemptible\\ncontext.\\n\\nrq is NULL when an ops invoked from an unlocked context. In such cases, we\\ndon\u0027t need to store any rq, since the value should already be NULL\\n(unlocked). Ensure that update_locked_rq() is only called when rq is\\nnon-NULL, preventing calling __this_cpu_write() on preemptible context.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/237c43037b336e36a49eb9f2daac1c7719ec7f8b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e14fd98c6d66cb76694b12c05768e4f9e8c95664\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}