{"id":"CVE-2026-98942","kind":"vulnerability","aliases":["CVE-2026-98942"],"related":[],"title":"Linux kernel sched_ext: racing BPF programs can read unfilled CPU ID tables","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Build the cid tables privately and publish them with RCU\n\nThe cid tables are visible to the cid kfuncs while being modified: the\nfirst enable publishes the global pointers before filling them,\nops.init_cids() overrides rewrite them in place, and re-enables rebuild\nthem in place. A racing TRACING or SYSCALL program can read unfilled\nentries, including uninitialized memory in the kmalloc'd tables, or torn\ntopo updates.\n\nTie the tables' lifetimes to the root sched instead: each root enable\nbuilds a fresh set privately and publishes the per-table __rcu globals once\nthe layout is final, and root disable unpublishes and RCU-frees the set. A\nnon-NULL global is now always a fully built table which stays valid for the\nreader's RCU read section, and lookups stay two loads. Kfuncs treat NULL as\nno-mapping, also after the scheduler exits instead of reporting the stale\nlast mapping.\n\nThe cid kfuncs are available whether the root scheduler is cid-form or\ncpu-form, the latter to allow gradual migration to cids. Every root\ntherefore builds and publishes a default mapping.\n\nEvery reader must either be gated on scheduler liveness or NULL-check\ninside an RCU read section. Fix the two kfuncs that were neither:\nscx_bpf_this_cid() read the table with no RCU or preemption protection and\nscx_bpf_task_cid() relied on KF_RCU, which doesn't put a sleepable program\nin an RCU read section. The hotplug callbacks are instead serialized by\nretiring the tables inside the cpus_read_lock() section that clears\nscx_root.\n\nv2: Document why every root builds the tables (desc + cid.c comment).","summary":"The sched_ext scheduler published its CPU ID mapping tables before filling them, so BPF programs calling the cid kfuncs could read uninitialized kernel memory or torn topology data. The fix builds the tables privately and publishes them with RCU.","severity":"unknown","cvss":null,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","linux-kernel","runtime","sched-ext"],"not_affected_if":["default-config"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T13:17:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:01+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:58:01Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel sched_ext: racing BPF programs can read unfilled CPU ID tables","impact":"low","summary":"The sched_ext scheduler published its CPU ID mapping tables before filling them, so BPF programs calling the cid kfuncs could read uninitialized kernel memory or torn topology data. The fix builds the tables privately and publishes them with RCU.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","sched-ext","bpf"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory read by a BPF program, possibly uninitialized data","analyst_note":"Find the fixed kernel versions and CVSS score in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-98942) and the upstream kernel commit.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running a Linux kernel with sched_ext enabled, where BPF programs of TRACING or SYSCALL type can call the scx_bpf cid kfuncs. The sources do not state the affected kernel versions or whether sched_ext is enabled by default.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000619,"input_tokens":3805,"output_tokens":476,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98942':16A,19A 'allow':255C 'also':223C 'alway':196C 'avail':239C 'bpf':6A,20B,42B,295C,309C 'build':59B,80C,161C,263C,353C 'built':199C 'call':44B 'callback':330C 'check':281C 'cid':46B,82C,91C,97C,113C,236C,246C,259C,297C,311C 'cid-form':245C 'cid.c':357C 'clear':345C 'comment':358C 'could':48B 'cpu':11A,34B,250C 'cpu-form':249C 'cpus':340C 'cve':14A,17A 'd':143C 'data':56B 'default':267C 'desc':356C 'disabl':181C 'document':349C 'doesn':317C 'either':272C 'enabl':104C,122C,160C 'entri':136C 'everi':260C,269C,351C 'exit':227C 'ext':4A,27B,30B,79C 'fill':39B,110C 'final':178C 'first':103C 'fix':58B,287C 'follow':73C 'form':247C,251C 'free':186C 'fresh':163C 'fulli':198C 'gate':274C 'global':107C,173C,193C 'gradual':256C 'hotplug':329C 'id':12A,35B 'includ':137C 'insid':282C,338C 'instead':157C,228C,332C 'kernel':2A,23B,51B,71C 'kf':314C 'kfunc':47B,98C,216C,237C,290C 'kmalloc':142C 'last':233C 'latter':253C 'layout':176C 'lifetim':152C 'linux':1A,22B,70C 'linux-kernel':21B 'live':277C 'load':215C 'lock':342C 'lookup':212C 'map':36B,222C,234C,268C 'memori':52B,139C 'migrat':257C 'modifi':101C 'must':271C 'neither':293C 'no-map':220C 'non':191C 'non-nul':190C 'null':192C,218C,280C 'null-check':279C 'ops.init':112C 'overrid':114C 'per':170C 'per-tabl':169C 'place':118C,126C 'pointer':108C 'preemption':305C 'privat':62B,84C,165C 'program':7A,43B,132C,322C 'protect':306C 'publish':32B,64B,86C,105C,167C,265C 'put':319C 'race':5A,128C 'rcu':67B,89C,172C,185C,208C,284C,303C,315C,325C 'rcu-fre':184C 're':121C 're-en':120C 'read':9A,49B,134C,209C,285C,298C,326C,341C 'reader':206C,270C 'rebuild':123C 'reli':312C 'report':230C 'resolv':77C 'retir':335C 'rewrit':115C 'root':155C,159C,180C,242C,261C,347C,352C 'runtim':24B 'sched':3A,26B,29B,78C,156C 'sched-ext':25B 'schedul':31B,226C,243C,276C 'scx':294C,308C,346C 'section':210C,286C,327C,343C 'serial':333C 'set':164C,188C 'sleepabl':321C 'stale':232C 'stay':202C,213C 'syscal':131C 'tabl':13A,37B,61B,83C,92C,144C,151C,171C,200C,300C,337C,355C 'task':310C 'therefor':262C 'tie':149C 'topo':147C 'topolog':55B 'torn':54B,146C 'trace':129C 'treat':217C 'two':214C,289C 'unfil':10A,135C 'uniniti':50B,138C 'unpublish':182C 'updat':148C 'v2':348C 'valid':203C 'visibl':94C 'vulner':74C 'whether':240C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with sched_ext enabled, where BPF programs of TRACING or SYSCALL type can call the scx_bpf cid kfuncs. The sources do not state the affected kernel versions or whether sched_ext is enabled by default.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98942","severity":null,"published_at":"2026-10-23T13:17:15+00:00","modified_at":"2026-10-23T13:17:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98942","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98942","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}