{"id":"CVE-2026-98864","kind":"vulnerability","aliases":["CVE-2026-98864"],"related":[],"title":"Linux kernel: sched_ext race can drop task dispatches after reenqueue","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task\n\nebf1ccff79c4 (\"sched_ext: Fix ops.dequeue() semantics\") moved the final\nops_state store in scx_dispatch_enqueue() after the DSQ unlock so that the\ncustody update and ops.dequeue() precede it. A task can thus be found on a\nDSQ while still SCX_OPSS_DISPATCHING.\n\nThe dequeue and core-sched pick paths wait for the state to clear in\nops_dequeue() but the reenqueue paths don't. A reenqueue in that window runs\nops.enqueue() and sets SCX_OPSS_QUEUED before the dispatch has completed.\nThe dispatcher's final store then overwrites it with SCX_OPSS_NONE and\nfinish_dispatch() drops every later dispatch of the task.\n\nWait for SCX_OPSS_DISPATCHING to clear before dequeueing a task for\nreenqueue, the same way ops_dequeue() does.","summary":"In the Linux kernel's sched_ext scheduler, a task can be reenqueued while its dispatch is still in progress, and the dispatcher's final state write then overwrites the queued state. The sources describe a scheduling correctness bug where later dispatches of the task are dropped; they do not describe code execution or data access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","sched-ext"],"not_affected_if":["default-config"],"how_to_check":"- unknown","fix":"- Apply the upstream kernel fix that makes reenqueue wait for SCX_OPSS_DISPATCHING to clear, referenced in the NVD entry for CVE-2026-98864\n- unknown","status":"open","published_at":"2026-10-18T16:17:40+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:50+00:00","updated_at":"2026-10-25T05:12:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:12:50Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the upstream kernel fix that makes reenqueue wait for SCX_OPSS_DISPATCHING to clear, referenced in the NVD entry for CVE-2026-98864\n- unknown","reach":"local","title":"Linux kernel: sched_ext race can drop task dispatches after reenqueue","impact":"low","summary":"In the Linux kernel's sched_ext scheduler, a task can be reenqueued while its dispatch is still in progress, and the dispatcher's final state write then overwrites the queued state. The sources describe a scheduling correctness bug where later dispatches of the task are dropped; they do not describe code execution or data access.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","sched-ext"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Scheduling of tasks breaks; dispatches are dropped","analyst_note":"Confirm affected kernel version range and whether sched_ext must be loaded; check the upstream kernel commit referenced in the NVD entry for the exact fix version and CVSS score.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running a Linux kernel that includes the sched_ext scheduler and the commit ebf1ccff79c4 (\"sched_ext: Fix ops.dequeue() semantics\"). The sources do not name affected kernel versions or whether sched_ext is enabled by default. unknown","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000639,"input_tokens":3597,"output_tokens":558,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98864':14A,17A 'access':80B 'bug':63B 'clear':158C,213C 'code':76B 'complet':184C 'core':149C 'core-sch':148C 'correct':62B 'custodi':125C 'cve':12A,15A 'data':79B 'dequeu':146C,161C,215C,224C 'describ':59B,75B 'dispatch':9A,40B,47B,66B,97C,116C,144C,182C,186C,199C,203C,211C 'drop':7A,71B,200C 'dsq':120C,139C 'ebf1ccff79c4':102C 'enqueu':117C 'everi':201C 'execut':77B 'ext':4A,24B,31B,92C,104C 'final':49B,110C,188C 'finish':198C 'fix':105C 'follow':86C 'found':136C 'infrastructur':18B 'kernel':2A,21B,28B,84C 'later':65B,202C 'linux':1A,20B,27B,83C 'linux-kernel':19B 'move':108C 'none':196C 'op':111C,160C,223C 'ops.dequeue':106C,128C 'ops.enqueue':174C 'opss':96C,143C,178C,195C,210C 'overwrit':53B,191C 'path':152C,165C 'pick':151C 'preced':129C 'progress':44B 'queu':55B,179C 'race':5A 'reenqueu':11A,37B,99C,164C,169C,219C 'resolv':90C 'run':173C 'sched':3A,23B,30B,91C,103C,150C 'sched-ext':22B 'schedul':32B,61B 'scx':95C,115C,142C,177C,194C,209C 'semant':107C 'set':176C 'sourc':58B 'state':50B,56B,112C,156C 'still':42B,141C 'store':113C,189C 'task':8A,34B,69B,101C,132C,206C,217C 'thus':134C 'unlock':121C 'updat':126C 'vulner':87C 'wait':93C,153C,207C 'way':222C 'window':172C 'write':51B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel that includes the sched_ext scheduler and the commit ebf1ccff79c4 (\"sched_ext: Fix ops.dequeue() semantics\"). The sources do not name affected kernel versions or whether sched_ext is enabled by default. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98864","severity":null,"published_at":"2026-10-18T16:17:40+00:00","modified_at":"2026-10-19T10:19:50+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}