Live › vulnerability › CVE-2026-99105
Go to dashboardIn the Linux kernel's sched_ext scheduler, a task enqueued with the SCX_ENQ_LAST flag can be placed on its CPU's local queue without the CPU being told to reschedule, so the CPU stays idle with the task waiting. The sources describe this as a stall that lasts until an unrelated wakeup or the watchdog fires, and report exiting tasks stuck for over 40 seconds under scx_mitosis; they do not describe a way for an attacker to gain access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Affects Linux systems running a sched_ext scheduler that sets SCX_OPS_ENQ_LAST without SCX_OPS_ENQ_EXITING, such as scx_mitosis as described in the sources. Systems on the stock kernel scheduler or sched_ext schedulers without these flags are not described as affected. The sources do not give fixed kernel versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ
With SCX_OPS_ENQ_LAST, the last runnable task on a CPU is passed to ops.enqueue() instead of being kept running. Exiting tasks without SCX_OPS_ENQ_EXITING, migration disabled tasks without SCX_OPS_ENQ_MIGRATION_DISABLED and tasks on an offline rq skip ops.enqueue() and go straight to the local DSQ. This happens in put_prev_task_scx() after the pick has settled on idle, so nothing reschedules the CPU, which idles with the task queued until an unrelated wakeup lands on it or the watchdog fires.
scx_mitosis, which sets SCX_OPS_ENQ_LAST without SCX_OPS_ENQ_EXITING, hit this during mass cgroup teardown: exiting tasks stuck in exit_mmap() for over 40 seconds.
A task put on the local DSQ runs, as anywhere else. If the SCX_ENQ_LAST enqueue left the task on this CPU's local DSQ, set need_resched on the task being switched in, as proxy_resched_idle() does. resched_curr() would flag the task being put instead, and __schedule() clears that right after the pick.
This page as .md · .json · in your agent: get_signal("CVE-2026-99105")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.