Linux Kernel: Race in sched_ext DSQ move causing concurrent task access
CVE-2026-99269 Published on November 3, 2026
sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
A task can be found on a non-local DSQ while the CPU which dispatched it
is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING.
The DSQ consume and move paths don't wait for the dispatch to finish and
can operate on the task concurrently with the dispatcher.
Call scx_wait_dispatching() in scx_move_local_task_to_local_dsq(),
unlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they
operate on the task. In scx_move_local_task_to_local_dsq(), wait before
scx_resolve_local_dsq() as it may update p->scx.flags.
Products Associated with CVE-2026-99269
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d and below cc2839946328c1618b3870d521b32bb9483d49d0 is affected.
- Version ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d and below 2935062be77113c1c4565ca9d0c72180449aafee is affected.
- Version 7.1 is affected.
- Before 7.1 is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.
- Version 7.3, <= * is unaffected.