The Linux kernel vulnerability (CVE-2026-89517) involves the core scheduling subsystem's pick_next_task() function, which selects tasks to run on SMT siblings under a shared core-wide runqueue (rq) lock. Previously, dispatch could drop this lock, causing interleaved selections on the same core to corrupt each other's rq->core_pick state, resulting in NULL dereferences or deadlocks. The fix makes pick_next_task() return RETRY_TASK whenever dispatch releases the rq lock, ensuring selections only commit picks made under a continuously held lock. Additional logic prevents dispatch conflicts and ensures balance callbacks run in the correct context, addressing the root cause of kernel hangs under heavy SMT load.

The vulnerability can cause kernel crashes due to NULL pointer dereferences and deadlocks resulting in hard hangs, particularly under heavy SMT load with frequent interleaved task selections. This can lead to system instability and denial of service conditions on affected Linux kernel versions.

A fix has been implemented in the Linux kernel to address this issue by modifying the core scheduling task selection logic. Users should apply the official kernel updates that include this fix. Since this is a kernel-level vulnerability, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly stated in the provided data; therefore, users should consult the official Linux kernel advisories or distribution updates for the specific patch availability and apply it accordingly.