CVE-2026-89516

sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users

Published Sep 11, 2026 CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users

scx_bpf_dsq_reenq() queues a deferred reenq (dru) that runs from
run_deferred(), not ops.dispatch(). If the DSQ is destroyed before the dru
runs, process_deferred_reenq_users() sees dsq->id == SCX_DSQ_INVALID and
hits the BUG_ON. destroy_dsq() doesn't flush pending drus, so just skip.

tj: Read dsq->id once with READ_ONCE(). Reading it separately in the INVALID
check and the BUG_ON would leave a window where destroy_dsq() can
invalidate the id between the two reads and still trigger the BUG_ON.

Analysis

Technical impact

A flaw in the Linux kernel’s scx_bpf_dsq subsystem causes a BUG_ON when a deferred reenqueuing (dru) operation runs on a DSQ that has already been destroyed. The kernel checks the DSQ identifier, sees it marked as invalid, and panics. This local denial‑of‑service is categorized as CWE‑825. The crash prevents the operating system from continuing to run until a reboot or kernel reload occurs.

Affected Systems

All Linux kernel versions prior to the published patch are affected. The vulnerability exists in the core kernel; it is not limited to a specific distribution or kernel release. Any system running an unpatched kernel can be impacted, regardless of distribution.

Risk and Exploitability

The CVSS score of 4.1 marks the vulnerability as moderate severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the description, it is inferred that the attack vector requires local or privileged access to manipulate DSQ objects so that destruction precedes the deferred reenqueuing; success would lead to a kernel panic and require a reboot.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`84b1a0ea0b7c23dec240783a592e480780efe459`	affected	< c480961a1e790b46ffd8c20c4b6754d65ec6572d
`84b1a0ea0b7c23dec240783a592e480780efe459`	affected	< 8d8dd8ae89eaa78b37fc85528e926029f5facbdf

Linux

affected

Version	Status	Constraints
`7.1`	affected	—
`0`	unaffected	< 7.1
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[84b1a0ea0b7c23dec240783a592e480780efe459,c480961a1e790b46ffd8c20c4b6754d65ec6572d)`	affected	code_commit	—
`[84b1a0ea0b7c23dec240783a592e480780efe459,8d8dd8ae89eaa78b37fc85528e926029f5facbdf)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`7.1`	affected	generic	—
`[0,7.1)`	unaffected	generic	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install the Linux kernel patch that corrects the DSQ handling bug.
Reboot the system after the kernel upgrade.
Disable or uninstall any third‑party kernel modules or drivers that interact with DSQ queues until the patch is applied so they do not cause premature DSQ destruction.

Generated by OpenCVE AI on September 15, 2026 at 22:20 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.198% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/8d8dd8ae89eaa78b37fc85528e926029f5facbdf
https://git.kernel.org/stable/c/c480961a1e790b46ffd8c20c4b6754d65ec6572d
https://nvd.nist.gov/vuln/detail/CVE-2026-89516
https://www.cve.org/CVERecord?id=CVE-2026-89516

History

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89516 https://www.cve.org/CVERecord?id=CVE-2026-89516
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users scx_bpf_dsq_reenq() queues a deferred reenq (dru) that runs from run_deferred(), not ops.dispatch(). If the DSQ is destroyed before the dru runs, process_deferred_reenq_users() sees dsq->id == SCX_DSQ_INVALID and hits the BUG_ON. destroy_dsq() doesn't flush pending drus, so just skip. tj: Read dsq->id once with READ_ONCE(). Reading it separately in the INVALID check and the BUG_ON would leave a window where destroy_dsq() can invalidate the id between the two reads and still trigger the BUG_ON.
Title		sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/8d8dd8ae89eaa78b37fc85528e926029f5facbdf https://git.kernel.org/stable/c/c480961a1e790b46ffd8c20c4b6754d65ec6572d