All vulnerabilities
CVE-2026-98864

Linux: sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in43457bf6550044c40bd6d3fcdf9ea66f5a55d139Also 7de9a6fb44eae4f05e68c805d58b9c618815adfaCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 43457bf6550044c40bd6d3fcdf9ea66f5a55d139LinuxCVE List
  • 7de9a6fb44eae4f05e68c805d58b9c618815adfaLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task

ebf1ccff79c4 ("sched_ext: Fix ops.dequeue() semantics") moved the final ops_state store in scx_dispatch_enqueue() after the DSQ unlock so that the custody update and ops.dequeue() precede it. A task can thus be found on a DSQ while still SCX_OPSS_DISPATCHING.

The dequeue and core-sched pick paths wait for the state to clear in ops_dequeue() but the reenqueue paths don't. A reenqueue in that window runs ops.enqueue() and sets SCX_OPSS_QUEUED before the dispatch has completed. The dispatcher's final store then overwrites it with SCX_OPSS_NONE and finish_dispatch() drops every later dispatch of the task.

Wait for SCX_OPSS_DISPATCHING to clear before dequeueing a task for reenqueue, the same way ops_dequeue() does.

Text from CVE List

Affected versions 6

  • Linuxaffected: ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d before 43457bf6550044c40bd6d3fcdf9ea66f5a55d139CVE List
  • Linuxaffected: ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d before 7de9a6fb44eae4f05e68c805d58b9c618815adfaCVE List
  • Linuxaffected: 7.1CVE List
  • Linuxunaffected: all versions before 7.1CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2