Description
In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags

schedule_deferred_locked() skips scheduling a deferred action while
SCX_RQ_IN_WAKEUP is set and relies on the task_woken_scx() call that follows
a wakeup enqueue to run it. enqueue_task_scx() sets the flag from the merged
enqueue flags, which include the flags stashed for a remote activation.
move_remote_task_to_local_dsq() thus sets SCX_RQ_IN_WAKEUP on the
destination rq when the moved task was woken up, although no
task_woken_scx() follows that activation.

An IMMED insert into a busy destination requests a local reenqueue during
that enqueue. The request gets linked but not scheduled and stays pending
until an unrelated wakeup or preemption on that CPU runs the deferred
actions. The IMMED task sits behind the running task in the meantime. If
nothing runs them before the scheduler is disabled, the request outlives the
scheduler and points into its freed per-cpu area, which the next scheduler
dereferences from run_deferred().

Test the core enqueue flags for the wakeup bit. Only the core's wakeup path
is followed by task_woken_scx().
Published: 2026-10-18
Score: 4.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Kernel Memory Corruption leading to a potential crash
Action: Patch
AI Analysis

Impact

The flaw in the Linux kernel, identified as CWE-825 (Core Dumping), arises from incorrectly applying the SCX_RQ_IN_WAKEUP flag during task enqueueing and missing the task_woken_scx() call. This leads to a deferred action being scheduled against a per‑CPU area that has already been freed. When run_deferred() later dereferences this stale pointer, the kernel experiences memory corruption that can culminate in a system crash.

Affected Systems

All Linux kernel installations that contain the unpatched scheduler code are affected. The available data does not specify a version range, so any kernel version older than the commit that applies the SCX_RQ_IN_WAKEUP fix could be vulnerable.

Risk and Exploitability

The CVSS score of 4.1 indicates low severity. The EPSS score is < 1%, showing a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. The flaw requires a specific scheduling condition that can be induced by task scheduling manipulation. No remote exploitation path is documented, so the likely attack vector is local and would cause a kernel crash if successfully triggered.

Generated by OpenCVE AI on October 20, 2026 at 20:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the kernel patch that addresses the flaw by properly clearing SCX_RQ_IN_WAKEUP; updates include the revisions that include commit 3fdf2ceb31e8 or 6c401ae426e20.
  • Reboot the system after the patch so the updated kernel is loaded and the scheduler runs the corrected code.
  • Perform a stress test that triggers high‑priority task scheduling (e.g., using stress‑ng or a custom IMMED enqueue test) and review the kernel log for any memory corruption or panic messages to confirm that the flaw has been mitigated.

Generated by OpenCVE AI on October 20, 2026 at 20:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Mon, 19 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags schedule_deferred_locked() skips scheduling a deferred action while SCX_RQ_IN_WAKEUP is set and relies on the task_woken_scx() call that follows a wakeup enqueue to run it. enqueue_task_scx() sets the flag from the merged enqueue flags, which include the flags stashed for a remote activation. move_remote_task_to_local_dsq() thus sets SCX_RQ_IN_WAKEUP on the destination rq when the moved task was woken up, although no task_woken_scx() follows that activation. An IMMED insert into a busy destination requests a local reenqueue during that enqueue. The request gets linked but not scheduled and stays pending until an unrelated wakeup or preemption on that CPU runs the deferred actions. The IMMED task sits behind the running task in the meantime. If nothing runs them before the scheduler is disabled, the request outlives the scheduler and points into its freed per-cpu area, which the next scheduler dereferences from run_deferred(). Test the core enqueue flags for the wakeup bit. Only the core's wakeup path is followed by task_woken_scx().
Title sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:20:01.130Z

Reserved: 2026-09-25T10:25:14.350Z

Link: CVE-2026-98463

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:16:56.770

Modified: 2026-10-19T10:18:55.960

Link: CVE-2026-98463

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98463 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T20:45:14Z

Weaknesses
  • CWE-825

    Expired Pointer Dereference