Live › vulnerability › CVE-2026-98865
Go to dashboardIn the Linux sched_ext framework, the ops.dequeue() callback runs while a user DSQ lock is still held, so a BPF scheduler that locks that same queue from inside the callback deadlocks the kernel. The sources describe a denial-of-service (hang) risk; they do not describe code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running a kernel built with sched_ext and loading a custom BPF scheduler are exposed, since the deadlock needs a scheduler whose ops.dequeue() locks a user DSQ. Hosts on the default kernel scheduler, or without sched_ext enabled, are not affected. Teams that run only stock distribution kernels with no custom BPF scheduler can skip this.
No product ranges from the sources yet.
uname -r to see the running kernel versiongrep -i sched_ext /boot/config-$(uname -r) and look for CONFIG_SCHED_CLASS_EXT=ybpftool struct show or ls /sys/kernel/sched_extEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Don't run ops.dequeue() with a DSQ lock held
ops.dequeue() is invoked with the source user DSQ's lock still held on the consume and move paths (scx_consume_dispatch_q(), move_task_between_dsqs()). A BPF scheduler which locks the source user DSQ from ops.dequeue() - e.g. by iterating it with bpf_iter_scx_dsq - self-deadlocks.
ops.dequeue() can only call the "any" kfuncs and none of them can lock a builtin DSQ, so the global and bypass paths can't deadlock; however, all DSQ locks share one lockdep class, so iterating any user DSQ from ops.dequeue() on those paths trips the recursion check.
Move the invocation after the DSQ unlock on all three paths. SCX_TASK_IN_CUSTODY is cleared under the lock serializing the transfer so that the callback is invoked exactly once.
This page as .md · .json · in your agent: get_signal("CVE-2026-98865")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.