{"id":"CVE-2026-98865","kind":"vulnerability","aliases":["CVE-2026-98865"],"related":[],"title":"Linux kernel: sched_ext BPF scheduler can self-deadlock on dequeue","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Don't run ops.dequeue() with a DSQ lock held\n\nops.dequeue() is invoked with the source user DSQ's lock still held on\nthe consume and move paths (scx_consume_dispatch_q(),\nmove_task_between_dsqs()). A BPF scheduler which locks the source user\nDSQ from ops.dequeue() - e.g. by iterating it with bpf_iter_scx_dsq -\nself-deadlocks.\n\nops.dequeue() can only call the \"any\" kfuncs and none of them can lock a\nbuiltin DSQ, so the global and bypass paths can't deadlock; however,\nall DSQ locks share one lockdep class, so iterating any user DSQ from\nops.dequeue() on those paths trips the recursion check.\n\nMove the invocation after the DSQ unlock on all three paths.\nSCX_TASK_IN_CUSTODY is cleared under the lock serializing the transfer\nso that the callback is invoked exactly once.","summary":"In the Linux sched_ext framework, the ops.dequeue() callback runs while a user DSQ lock is still held, so a BPF scheduler that locks that same queue from inside the callback deadlocks the kernel. The sources describe a denial-of-service (hang) risk; they do not describe code execution or data exposure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","kernel","linux","runtime","sched-ext"],"not_affected_if":["default-config","no-custom-bpf-scheduler"],"how_to_check":"- `uname -r` to see the running kernel version\n- Check whether sched_ext is in use: `grep -i sched_ext /boot/config-$(uname -r)` and look for CONFIG_SCHED_CLASS_EXT=y\n- Check whether a BPF sched_ext scheduler is loaded: `bpftool struct show` or `ls /sys/kernel/sched_ext`","fix":"- Move to a Linux kernel release that contains the upstream sched_ext fix for this CVE (exact fixed version: unknown in the sources)\n- Until patched, avoid loading BPF schedulers that iterate user DSQs from ops.dequeue() (unknown from sources)","status":"open","published_at":"2026-10-18T16:17:40+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:49+00:00","updated_at":"2026-10-25T05:12:49+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:12:49Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Linux kernel release that contains the upstream sched_ext fix for this CVE (exact fixed version: unknown in the sources)\n- Until patched, avoid loading BPF schedulers that iterate user DSQs from ops.dequeue() (unknown from sources)","reach":"local","title":"Linux kernel: sched_ext BPF scheduler can self-deadlock on dequeue","impact":"medium","summary":"In the Linux sched_ext framework, the ops.dequeue() callback runs while a user DSQ lock is still held, so a BPF scheduler that locks that same queue from inside the callback deadlocks the kernel. The sources describe a denial-of-service (hang) risk; they do not describe code execution or data exposure.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","sched-ext","bpf"],"confidence":0.6,"needs_auth":"unknown","worst_case":"kernel deadlock hangs the affected host","analyst_note":"Confirm fixed kernel versions and stable backport commits for this CVE from the NVD entry or the kernel.org stable mailing list.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether sched_ext is in use: `grep -i sched_ext /boot/config-$(uname -r)` and look for CONFIG_SCHED_CLASS_EXT=y\n- Check whether a BPF sched_ext scheduler is loaded: `bpftool struct show` or `ls /sys/kernel/sched_ext`","needs_analyst":true,"not_affected_if":["default-config","no-custom-bpf-scheduler"],"who_is_affected":"Only systems running a kernel built with sched_ext and loading a custom BPF scheduler are exposed, since the deadlock needs a scheduler whose ops.dequeue() locks a user DSQ. Hosts on the default kernel scheduler, or without sched_ext enabled, are not affected. Teams that run only stock distribution kernels with no custom BPF scheduler can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000727,"input_tokens":3568,"output_tokens":741,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98865':15A,18A 'bpf':5A,19B,46B,127C,142C 'builtin':163C 'bypass':169C 'call':152C 'callback':34B,56B,222C 'check':195C 'class':181C 'clear':212C 'code':74B 'consum':114C,119C 'custodi':210C 'cve':13A,16A 'data':77B 'deadlock':10A,57B,148C,173C 'denial':65B 'denial-of-servic':64B 'dequeu':12A 'describ':62B,73B 'dispatch':120C 'dsq':39B,97C,107C,134C,145C,164C,176C,186C,201C 'dsqs':125C 'e.g':137C 'exact':225C 'execut':75B 'exposur':78B 'ext':4A,25B,30B,90C 'follow':84C 'framework':31B 'global':167C 'hang':68B 'held':43B,99C,111C 'howev':174C 'insid':54B 'invoc':198C 'invok':102C,224C 'iter':139C,143C,183C 'kernel':2A,20B,59B,82C 'kfunc':155C 'linux':1A,21B,28B,81C 'lock':40B,49B,98C,109C,130C,161C,177C,215C 'lockdep':180C 'move':116C,122C,196C 'none':157C 'one':179C 'ops.dequeue':33B,94C,100C,136C,149C,188C 'path':117C,170C,191C,206C 'q':121C 'queue':52B 'recurs':194C 'resolv':88C 'risk':69B 'run':35B,93C 'runtim':22B 'sched':3A,24B,29B,89C 'sched-ext':23B 'schedul':6A,47B,128C 'scx':118C,144C,207C 'self':9A,147C 'self-deadlock':8A,146C 'serial':216C 'servic':67B 'share':178C 'sourc':61B,105C,132C 'still':42B,110C 'task':123C,208C 'three':205C 'transfer':218C 'trip':192C 'unlock':202C 'user':38B,106C,133C,185C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a kernel built with sched_ext and loading a custom BPF scheduler are exposed, since the deadlock needs a scheduler whose ops.dequeue() locks a user DSQ. Hosts on the default kernel scheduler, or without sched_ext enabled, are not affected. Teams that run only stock distribution kernels with no custom BPF scheduler can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98865","severity":null,"published_at":"2026-10-18T16:17:40+00:00","modified_at":"2026-10-19T10:19:50+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}