{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.94-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.13-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()  A WARN fires when systemd's user manager writes \"+cpu +memory +pids\" to its own subtree_control while a sched_ext scheduler is loaded:    WARNING: at kernel/sched/ext.c:3227 scx_cgroup_move_task+0xa8/0xb0    scx_cgroup_move_task+0xa8/0xb0    sched_move_task+0x134/0x290    cpu_cgroup_attach+0x39/0x70    cgroup_migrate_execute+0x37d/0x450    cgroup_update_dfl_csses+0x1e3/0x270    cgroup_subtree_control_write+0x3e7/0x440  scx_cgroup_can_attach() arms cgrp_moving_from only when a task's cpu cgroup changes. It can still be NULL when scx_cgroup_move_task() runs, through this sequence:    Step                               Result   ---------------------------------  ----------------------------------   1. cpu enabled on cgroup G         cpu css = A   2. cpu toggled off then on for G   A killed, B created (same cgroup)   3. an exiting task keeps A alive   migration skips it, A now stale   4. +memory migrates G              stale A vs current B pulls cpu in   5. cpu attach runs for all tasks   hits a live, cpu-unchanged task   6. scx_cgroup_move_task() on it    cgrp_moving_from NULL -\u003e WARN  The mismatch is that scx_cgroup_can_attach() keys on cgroup identity while migration drives the move on css identity, so a NULL cgrp_moving_from here is a legitimate css-only migration, not a missing prep.  The call is already gated on cgrp_moving_from, so just drop the warning. ops.cgroup_prep_move() and ops.cgroup_move() stay paired.",
  "id": "DEBIAN-CVE-2026-53328",
  "modified": "2026-09-14T16:47:41.066005017Z",
  "published": "2026-07-01T14:16:40.650Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-53328"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-53328"
  ]
}