The Linux kernel sched_ext scheduler had a vulnerability where a WARN message was triggered in scx_cgroup_move_task() due to a NULL cgrp_moving_from pointer. This happens when systemd's user manager writes "+cpu +memory +pids" to its subtree_control while sched_ext is loaded. The root cause is a mismatch between how scx_cgroup_can_attach() and the migration logic identify cgroups and css, resulting in a legitimate css-only migration being mistaken for a missing preparation step. The fix involved removing the warning since the NULL cgrp_moving_from is expected in this scenario and does not indicate an error.

The vulnerability does not impact confidentiality, integrity, or availability of the system. The CVSS vector indicates no impact on confidentiality or integrity but a high impact on availability due to the kernel WARN. However, this WARN is a warning message, not a crash or denial of service. There are no known exploits in the wild. The issue primarily causes noisy kernel warnings under specific conditions without functional disruption.

A fix has been implemented in the Linux kernel to remove the warning on NULL cgrp_moving_from in scx_cgroup_move_task(). Since this is a resolved issue, users should update their Linux kernel to a version that includes this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel release notes for the official fixed version and apply updates accordingly.