The vulnerability in the Linux kernel's core scheduling was due to the SCX_RQ_BAL_KEEP flag, a leftover from when balancing and picking were separate operations. This flag was rq-level and only valid when dispatches and picks paired one-to-one. Core scheduling breaks this assumption by interleaving selections through dispatch's lock drops, allowing a pick to consume a stale flag and keep a task that has since been dequeued. The fix involves making scx_dispatch_sched() and balance_one() return an explicit dispatch verdict and removing the flag's plumbing from the tools autogen enum headers. Additionally, the pick-side invocation and related queueing and checks were refactored without functional changes.

The vulnerability could cause the scheduler to keep running a task that has already been dequeued, potentially leading to incorrect task scheduling behavior. No specific exploitation details or broader impacts are provided.

A fix has been implemented in the Linux kernel to replace the problematic SCX_RQ_BAL_KEEP flag with an explicit dispatch verdict return. Users should update to the fixed kernel version once available. No other mitigation steps are indicated.