Description
In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor

scx_bypass() claims bypass dispatch when the scheduler's depth goes from
zero to one and releases it when the depth returns to zero, but propagates
only the depth to the descendants, not the claim. A descendant that starts
bypassing with its ancestor never claims, and one whose own bypass ends
under the ancestor's keeps its claim, as its depth does not return to zero.

A sub-scheduler enable whose bypass ends under a PM suspend thus leaks its
claim: the parent keeps hosting bypass dispatch and the sub-scheduler's next
bypass trips the WARN_ON_ONCE() on the claim. A sub-scheduler disable that
starts under a PM suspend has no claim, so once the resume lifts the root's
bypass its tasks sit on the parent's bypass DSQs with nobody consuming them.

Claim for every descendant whose depth goes from zero to one in the
propagation and release every scheduler in the subtree whose depth returned
to zero once the tasks have moved out of the bypass DSQs. A parent that is
bypassing itself when a descendant claims consumes only its own bypass DSQs,
empty until it leaves bypass and becomes the host.
Published: 2026-10-28
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

The vulnerability arises from incorrect propagation of bypass claims in the Linux kernel scheduler. When a scheduler’s depth changes from zero to one, the claim is not properly passed to descendants, allowing a sub‑scheduler to inherit a stale claim or lose its claim during power‑management transitions. This can cause tasks to remain on depth‑synchronization queues with no consumer, effectively stalling scheduled work and potentially leading to a system hang or severe performance degradation.

Affected Systems

This issue affects all releases of the Linux kernel on Linux systems, as the change applies to the core scheduler code. No specific kernel version range is supplied, so all current releases may contain the bug until the patch is applied.

Risk and Exploitability

No epSS score is available and the vulnerability is not listed in the CISA KEV catalog, which suggests there are currently no known public exploits. The risk of exploitation depends on an attacker’s ability to influence kernel scheduler behavior, typically requiring elevated or kernel privileges. Because the flaw is internal to the kernel scheduler, the likelihood of successful exploitation remains moderate, but the impact of an accidental or intentional trigger is significant, potentially leading to denial of service.

Generated by OpenCVE AI on October 28, 2026 at 11:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Linux kernel update that contains the sched_ext claim propagation fix
  • If an immediate kernel update is not possible, temporarily disable or avoid using sub‑schedulers during system suspend and resume operations to prevent claim leakage
  • Monitor kernel logs for WARN_ON_ONCE warnings indicating claim propagation issues and investigate any timing mismatches between suspend/resume and scheduler re‑enable actions

Generated by OpenCVE AI on October 28, 2026 at 11:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665

Wed, 28 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux linux
Vendors & Products Linux linux

Wed, 28 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scx_bypass() claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the depth returns to zero, but propagates only the depth to the descendants, not the claim. A descendant that starts bypassing with its ancestor never claims, and one whose own bypass ends under the ancestor's keeps its claim, as its depth does not return to zero. A sub-scheduler enable whose bypass ends under a PM suspend thus leaks its claim: the parent keeps hosting bypass dispatch and the sub-scheduler's next bypass trips the WARN_ON_ONCE() on the claim. A sub-scheduler disable that starts under a PM suspend has no claim, so once the resume lifts the root's bypass its tasks sit on the parent's bypass DSQs with nobody consuming them. Claim for every descendant whose depth goes from zero to one in the propagation and release every scheduler in the subtree whose depth returned to zero once the tasks have moved out of the bypass DSQs. A parent that is bypassing itself when a descendant claims consumes only its own bypass DSQs, empty until it leaves bypass and becomes the host.
Title sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-28T10:34:23.729Z

Reserved: 2026-09-25T10:25:14.391Z

Link: CVE-2026-99104

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T11:17:29.733

Modified: 2026-10-28T11:17:29.733

Link: CVE-2026-99104

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T12:00:22Z

Weaknesses