---
id: "CVE-2026-99269"
kind: "vulnerability"
aliases: ["CVE-2026-99269"]
title: "Linux kernel: sched_ext race can corrupt task scheduling state"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux-kernel", "runtime", "sched-ext", "self-hosted"]
not_affected_if: ["default-scheduler"]
published_at: "2026-11-03T12:17:34+00:00"
first_seen_at: "2026-11-03T12:20:40+00:00"
updated_at: "2026-11-03T12:22:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99269", "first_seen_at": "2026-11-03T12:20:40+00:00"}]
---

# Linux kernel: sched_ext race can corrupt task scheduling state

In the Linux kernel's sched_ext scheduler, a task can be moved between dispatch queues while the CPU that dispatched it has not finished its dequeue step, so two code paths operate on the same task at once. The sources do not state what an attacker gains from this race.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running kernel version with `uname -r` and compare it against the fixed versions in the kernel stable branches once listed.
- Check whether sched_ext is enabled on the machine (a BPF-based scheduler loaded via `sched_ext` in `/sys/kernel/sched_ext/`), since the flaw is in that code path.

## Timeline

- 2026-11-03T12:20:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99269

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs

A task can be found on a non-local DSQ while the CPU which dispatched it
is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING.
The DSQ consume and move paths don't wait for the dispatch to finish and
can operate on the task concurrently with the dispatcher.

Call scx_wait_dispatching() in scx_move_local_task_to_local_dsq(),
unlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they
operate on the task. In scx_move_local_task_to_local_dsq(), wait before
scx_resolve_local_dsq() as it may update p->scx.flags.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_