Live › vulnerability › CVE-2026-99269
In the Linux kernel's sched_ext scheduler, a task can be moved between dispatch queues while the CPU that dispatched it has not finished its dequeue step, so two code paths operate on the same task at once. The sources do not state what an attacker gains from this race.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 12:20 UTC. All times on this page are UTC.
The flaw is in the kernel's sched_ext code, which only runs when a BPF-based scheduler is loaded. Systems using the default kernel scheduler are likely not exposed, but the sources do not confirm this. unknown
No product ranges from the sources yet.
uname -r and compare it against the fixed versions in the kernel stable branches once listed.sched_ext in /sys/kernel/sched_ext/), since the flaw is in that code path.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING. The DSQ consume and move paths don't wait for the dispatch to finish and can operate on the task concurrently with the dispatcher.
Call scx_wait_dispatching() in scx_move_local_task_to_local_dsq(), unlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they operate on the task. In scx_move_local_task_to_local_dsq(), wait before scx_resolve_local_dsq() as it may update p->scx.flags.
This page as .md · .json · in your agent: get_signal("CVE-2026-99269")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.