{"id":"CVE-2026-99269","kind":"vulnerability","aliases":["CVE-2026-99269"],"related":[],"title":"Linux kernel: sched_ext race can corrupt task scheduling state","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs\n\nA task can be found on a non-local DSQ while the CPU which dispatched it\nis still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING.\nThe DSQ consume and move paths don't wait for the dispatch to finish and\ncan operate on the task concurrently with the dispatcher.\n\nCall scx_wait_dispatching() in scx_move_local_task_to_local_dsq(),\nunlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they\noperate on the task. In scx_move_local_task_to_local_dsq(), wait before\nscx_resolve_local_dsq() as it may update p->scx.flags.","summary":"In the Linux kernel's sched_ext scheduler, a task can be moved between dispatch queues while the CPU that dispatched it has not finished its dequeue step, so two code paths operate on the same task at once. The sources do not state what an attacker gains from this race.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","sched-ext","self-hosted"],"not_affected_if":["default-scheduler"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed versions in the kernel stable branches once listed.\n- Check whether sched_ext is enabled on the machine (a BPF-based scheduler loaded via `sched_ext` in `/sys/kernel/sched_ext/`), since the flaw is in that code path.","fix":null,"status":"open","published_at":"2026-11-03T12:17:34+00:00","first_seen_at":"2026-11-03T12:20:40+00:00","triaged_at":"2026-11-03T12:22:38+00:00","updated_at":"2026-11-03T12:22:38+00:00","category":"runtime","confidence":0.3,"triage":{"at":"2026-11-03T12:22:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: sched_ext race can corrupt task scheduling state","impact":"medium","summary":"In the Linux kernel's sched_ext scheduler, a task can be moved between dispatch queues while the CPU that dispatched it has not finished its dequeue step, so two code paths operate on the same task at once. The sources do not state what an attacker gains from this race.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","sched-ext","self-hosted"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown, the sources do not describe the impact","analyst_note":"Check the NVD entry and the kernel.org stable commit for the impact and fixed kernel versions.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed versions in the kernel stable branches once listed.\n- Check whether sched_ext is enabled on the machine (a BPF-based scheduler loaded via `sched_ext` in `/sys/kernel/sched_ext/`), since the flaw is in that code path.","plain_action":"","needs_analyst":true,"not_affected_if":["default-scheduler"],"who_is_affected":"The flaw is in the kernel's sched_ext code, which only runs when a BPF-based scheduler is loaded. Systems using the default kernel scheduler are likely not exposed, but the sources do not confirm this. unknown","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00071,"input_tokens":4320,"output_tokens":555,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99269':13A,16A 'attack':73B 'call':152C 'clear':124C 'code':57B 'concurr':148C 'consum':130C 'corrupt':7A 'cpu':45B,113C 'cve':11A,14A 'dequeu':53B 'dispatch':41B,47B,94C,115C,127C,139C,151C,155C 'dsq':110C,129C,163C,165C,188C,194C 'dsqs':99C,174C 'ext':4A,23B,33B,89C 'finish':51B,141C 'follow':83C 'found':104C 'gain':74B 'hasn':122C 'host':26B 'kernel':2A,19B,30B,81C 'linux':1A,18B,29B,80C 'linux-kernel':17B 'local':109C,159C,162C,184C,187C,193C 'lock':169C 'may':197C 'move':39B,96C,132C,158C,171C,183C 'non':108C 'non-loc':107C 'oper':59B,144C,177C 'ops.dequeue':120C 'opss':93C,126C 'p':199C 'path':58B,133C 'queue':42B 'race':5A,77B 'resolv':87C,192C 'rq':168C 'run':119C 'runtim':20B 'sched':3A,22B,32B,88C 'sched-ext':21B 'schedul':9A,34B 'scx':92C,125C,153C,157C,182C,191C 'scx.flags':200C 'self':25B 'self-host':24B 'sourc':67B 'state':10A,70B 'step':54B 'still':118C 'switch':167C 'task':8A,36B,63B,97C,101C,147C,160C,172C,180C,185C 'two':56B 'unlink':164C 'updat':198C 'vulner':84C 'wait':90C,136C,154C,189C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the kernel's sched_ext code, which only runs when a BPF-based scheduler is loaded. Systems using the default kernel scheduler are likely not exposed, but the sources do not confirm this. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linuxkernel","runtime","schedext","selfhosted","unknown"],"first_public_at":"2026-11-03T12:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99269","severity":null,"published_at":"2026-11-03T12:17:34+00:00","modified_at":"2026-11-03T12:17:34+00:00","first_seen_at":"2026-11-03T12:20:40+00:00","fetched_at":"2026-11-03T12:20:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}