Description
In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task

ebf1ccff79c4 ("sched_ext: Fix ops.dequeue() semantics") moved the final
ops_state store in scx_dispatch_enqueue() after the DSQ unlock so that the
custody update and ops.dequeue() precede it. A task can thus be found on a
DSQ while still SCX_OPSS_DISPATCHING.

The dequeue and core-sched pick paths wait for the state to clear in
ops_dequeue() but the reenqueue paths don't. A reenqueue in that window runs
ops.enqueue() and sets SCX_OPSS_QUEUED before the dispatch has completed.
The dispatcher's final store then overwrites it with SCX_OPSS_NONE and
finish_dispatch() drops every later dispatch of the task.

Wait for SCX_OPSS_DISPATCHING to clear before dequeueing a task for
reenqueue, the same way ops_dequeue() does.
Published: 2026-10-18
Score: n/a
EPSS: n/a
KEV: No
Impact: Scheduling disruption potentially leading to denial of service
Action: Apply patch
AI Analysis

Impact

A race condition in the Linux kernel scheduler can cause a task that is in the SCX_OPSS_DISPATCHING state to be requeued before the dispatch completes. This results in the task’s state being overwritten and the task being dropped from subsequent dispatches, potentially causing erratic scheduling or loss of task execution. The flaw does not expose obvious information disclosure or code execution paths but can degrade system responsiveness.

Affected Systems

All Linux kernel installations that include the vulnerable scheduling code. No specific version string is provided, so any kernel prior to the applied fix is affected. Distribution maintainers should examine the kernel release notes for the commit that introduced the fix.

Risk and Exploitability

The EPSS score and KEV status are not available, and no public exploits are reported. The CVSS score is not provided in the advisory. The attack vector is likely local or requires elevated privileges to manipulate kernel scheduling behavior. Because the flaw leads to loss of task dispatches, it could be exploited to cause a denial‑of‑service condition but is not currently a high‑impact vulnerability. The risk is moderate until a patched kernel is deployed.

Generated by OpenCVE AI on October 18, 2026 at 20:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that contains the fix for this scheduling bug, such as the latest stable release from the distribution’s security updates.
  • If an immediate kernel update is not possible, review and adjust any custom scheduling extensions or hooks to ensure they do not requeue tasks while SCX_OPSS_DISPATCHING is pending; apply any vendor‑supplied patches or backports.
  • Continuously monitor system logs for anomalies in task scheduling or unexpected task drops that may indicate the presence of this issue.

Generated by OpenCVE AI on October 18, 2026 at 20:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task ebf1ccff79c4 ("sched_ext: Fix ops.dequeue() semantics") moved the final ops_state store in scx_dispatch_enqueue() after the DSQ unlock so that the custody update and ops.dequeue() precede it. A task can thus be found on a DSQ while still SCX_OPSS_DISPATCHING. The dequeue and core-sched pick paths wait for the state to clear in ops_dequeue() but the reenqueue paths don't. A reenqueue in that window runs ops.enqueue() and sets SCX_OPSS_QUEUED before the dispatch has completed. The dispatcher's final store then overwrites it with SCX_OPSS_NONE and finish_dispatch() drops every later dispatch of the task. Wait for SCX_OPSS_DISPATCHING to clear before dequeueing a task for reenqueue, the same way ops_dequeue() does.
Title sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:51:25.532Z

Reserved: 2026-09-25T10:25:14.377Z

Link: CVE-2026-98864

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:40.877

Modified: 2026-10-18T16:17:40.877

Link: CVE-2026-98864

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T21:00:10Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')