{"id":"CVE-2026-99105","kind":"vulnerability","aliases":["CVE-2026-99105"],"related":[],"title":"Linux kernel: sched_ext task can sit queued and stall a CPU","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ\n\nWith SCX_OPS_ENQ_LAST, the last runnable task on a CPU is passed to\nops.enqueue() instead of being kept running. Exiting tasks without\nSCX_OPS_ENQ_EXITING, migration disabled tasks without\nSCX_OPS_ENQ_MIGRATION_DISABLED and tasks on an offline rq skip ops.enqueue()\nand go straight to the local DSQ. This happens in put_prev_task_scx() after\nthe pick has settled on idle, so nothing reschedules the CPU, which idles\nwith the task queued until an unrelated wakeup lands on it or the watchdog\nfires.\n\nscx_mitosis, which sets SCX_OPS_ENQ_LAST without SCX_OPS_ENQ_EXITING, hit\nthis during mass cgroup teardown: exiting tasks stuck in exit_mmap() for\nover 40 seconds.\n\nA task put on the local DSQ runs, as anywhere else. If the SCX_ENQ_LAST\nenqueue left the task on this CPU's local DSQ, set need_resched on the task\nbeing switched in, as proxy_resched_idle() does. resched_curr() would flag\nthe task being put instead, and __schedule() clears that right after the\npick.","summary":"In the Linux kernel's sched_ext scheduler, a task enqueued with the SCX_ENQ_LAST flag can be placed on its CPU's local queue without the CPU being told to reschedule, so the CPU stays idle with the task waiting. The sources describe this as a stall that lasts until an unrelated wakeup or the watchdog fires, and report exiting tasks stuck for over 40 seconds under scx_mitosis; they do not describe a way for an attacker to gain access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","runtime","sched-ext"],"not_affected_if":["default-scheduler"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-28T11:17:29+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:37:50+00:00","updated_at":"2026-10-28T11:37:50+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-28T11:37:50Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: sched_ext task can sit queued and stall a CPU","impact":"low","summary":"In the Linux kernel's sched_ext scheduler, a task enqueued with the SCX_ENQ_LAST flag can be placed on its CPU's local queue without the CPU being told to reschedule, so the CPU stays idle with the task waiting. The sources describe this as a stall that lasts until an unrelated wakeup or the watchdog fires, and report exiting tasks stuck for over 40 seconds under scx_mitosis; they do not describe a way for an attacker to gain access.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","sched-ext"],"confidence":0.4,"needs_auth":"unknown","worst_case":"CPUs stall and tasks hang, causing denial of service","analyst_note":"Find the fixed kernel versions and affected stable branches in the NVD entry and the upstream kernel commit for the sched_ext SCX_ENQ_LAST fix.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["default-scheduler"],"who_is_affected":"Affects Linux systems running a sched_ext scheduler that sets SCX_OPS_ENQ_LAST without SCX_OPS_ENQ_EXITING, such as scx_mitosis as described in the sources. Systems on the stock kernel scheduler or sched_ext schedulers without these flags are not described as affected. The sources do not give fixed kernel versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000657,"input_tokens":3704,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99105':15A,18A '40':91B,253C 'access':107B 'anywher':264C 'attack':104B 'back':131C 'cgroup':243C 'clear':306C 'cpu':12A,47B,53B,60B,134C,149C,208C,277C 'curr':296C 'cve':13A,16A 'describ':69B,99B 'disabl':167C,174C 'dsq':137C,189C,261C,280C 'els':265C 'enq':39B,128C,141C,164C,172C,232C,237C,269C 'enqueu':35B,125C,271C 'exit':86B,159C,165C,238C,245C,249C 'ext':4A,24B,31B,119C 'fire':83B,225C 'fix':120C 'flag':41B,298C 'follow':113C 'gain':106B 'go':184C 'happen':191C 'hit':239C 'idl':62B,203C,210C,293C 'instead':154C,303C 'kept':157C 'kernel':2A,19B,28B,111C 'land':130C,219C 'last':40B,75B,129C,142C,144C,233C,270C 'left':272C 'linux':1A,20B,27B,110C 'local':49B,136C,188C,260C,279C 'mass':242C 'migrat':166C,173C 'mitosi':95B,227C 'mmap':250C 'need':282C 'noth':205C 'offlin':179C 'op':140C,163C,171C,231C,236C 'ops.enqueue':153C,182C 'pass':151C 'pick':199C,311C 'place':44B 'prev':194C 'proxi':291C 'put':193C,257C,302C 'queu':8A,214C 'queue':50B 'report':85B 'resch':283C,292C,295C 'reschedul':57B,206C 'resolv':117C 'right':308C 'rq':180C 'run':158C,262C 'runnabl':145C 'runtim':21B 'sched':3A,23B,30B,118C 'sched-ext':22B 'schedul':32B,305C 'scx':38B,94B,127C,139C,162C,170C,196C,226C,230C,235C,268C 'second':92B,254C 'set':229C,281C 'settl':201C 'sit':7A 'skip':181C 'sourc':68B 'stall':10A,73B,121C 'stay':61B 'straight':185C 'stuck':88B,247C 'switch':288C 'task':5A,34B,65B,87B,124C,146C,160C,168C,176C,195C,213C,246C,256C,274C,286C,300C 'teardown':244C 'told':55B 'unrel':78B,217C 'vulner':114C 'wait':66B 'wakeup':79B,218C 'watchdog':82B,224C 'way':101B 'without':51B,161C,169C,234C 'would':297C","nicknames":[],"mitigations":[],"who_affected":"Affects Linux systems running a sched_ext scheduler that sets SCX_OPS_ENQ_LAST without SCX_OPS_ENQ_EXITING, such as scx_mitosis as described in the sources. Systems on the stock kernel scheduler or sched_ext schedulers without these flags are not described as affected. The sources do not give fixed kernel versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99105","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99105","severity":null,"published_at":"2026-10-28T11:17:29+00:00","modified_at":"2026-10-28T11:17:29+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}