---
id: "CVE-2026-99144"
kind: "vulnerability"
aliases: ["CVE-2026-99144"]
title: "Linux kernel: sched_ext use-after-free of destroyed user queue"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux-kernel", "runtime", "sched-ext"]
not_affected_if: []
published_at: "2026-10-28T11:17:34+00:00"
first_seen_at: "2026-10-28T11:32:35+00:00"
updated_at: "2026-10-28T11:36:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99144", "first_seen_at": "2026-10-28T11:32:35+00:00"}]
---

# Linux kernel: sched_ext use-after-free of destroyed user queue

A deferred reenqueue request in the sched_ext scheduler can read a user dispatch queue after it has been freed. The sources do not state what an attacker gets beyond a read of freed memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-28T11:32:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99144

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue

A deferred reenqueue can read a freed user DSQ. The request stays on its
CPU's deferred list until run_deferred() takes it, and the RCU callback that
frees the DSQ assumes that the grace period has flushed it, so exit_dsq()
checks the per-CPU node without the deferred list lock. A grace period waits
for readers in flight, not for a pending run_deferred(). A run_deferred()
which starts after the grace period began can detach the request right
before the callback looks and then read the freed DSQ's id.

Cancel the pending requests before the grace period instead. The irq work
that frees the DSQ unlinks every CPU's request under the per-CPU deferred
list lock, and schedule_dsq_reenq() ignores a new request under the same
lock once the id is invalid. Only a run_deferred() that started before the
grace period can hold a request, and it runs with IRQs disabled, so the
grace period waits for it and nothing touches the DSQ after the callback.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_