Description
In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ

With SCX_OPS_ENQ_LAST, the last runnable task on a CPU is passed to
ops.enqueue() instead of being kept running. Exiting tasks without
SCX_OPS_ENQ_EXITING, migration disabled tasks without
SCX_OPS_ENQ_MIGRATION_DISABLED and tasks on an offline rq skip ops.enqueue()
and go straight to the local DSQ. This happens in put_prev_task_scx() after
the pick has settled on idle, so nothing reschedules the CPU, which idles
with the task queued until an unrelated wakeup lands on it or the watchdog
fires.

scx_mitosis, which sets SCX_OPS_ENQ_LAST without SCX_OPS_ENQ_EXITING, hit
this during mass cgroup teardown: exiting tasks stuck in exit_mmap() for
over 40 seconds.

A task put on the local DSQ runs, as anywhere else. If the SCX_ENQ_LAST
enqueue left the task on this CPU's local DSQ, set need_resched on the task
being switched in, as proxy_resched_idle() does. resched_curr() would flag
the task being put instead, and __schedule() clears that right after the
pick.
Published: 2026-10-28
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Assess Impact
AI Analysis

Impact

A flaw in the Linux kernel scheduler causes a task that is enqueued with SCX_ENQ_LAST to stall when it returns to its CPU’s local dispatch queue. This results in the CPU idling without rescheduling, which keeps the task queued until an unrelated wake‑up or the watchdog fires. In mass cgroup teardown scenarios, this can freeze exiting tasks within the exit_mmap() phase for over 40 seconds, effectively degrading system responsiveness and preventing normal CPU utilization. The weakness enables an attacker with sufficient privileges to cause substantial delays or unavailability for the affected tasks, presenting a denial‑of‑service scenario at the kernel level.

Affected Systems

The vulnerability affects the Linux kernel on all platforms and architectures. Vendor and product information lists the operating system as Linux:Linux, and no specific kernel version is excluded; the fix applies to any release that incorporates the reported changes.

Risk and Exploitability

Official CVSS and EPSS scores are not provided, and the vulnerability is not listed in the CISA KEV catalog, which indicates that there is no public evidence of exploitation yet. Nonetheless, the bug can be triggered by a privileged process that enqueues tasks with SCX_OPS_ENQ_LAST and can lead to significant performance degradation. Because the attack requires kernel‑level access, the potential impact remains high for affected systems until the kernel is updated.

Generated by OpenCVE AI on October 28, 2026 at 11:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to a Linux kernel version that incorporates the fix from the referenced commits (396ba6f, 7a9df76, 8d891c2).
  • If rolling your own kernel, apply the patch changes from the provided git references to the scheduling subsystem before building the kernel.
  • Reboot the system to ensure the new kernel is active and the scheduling behavior is restored.

Generated by OpenCVE AI on October 28, 2026 at 11:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Linux linux
Vendors & Products Linux linux

Wed, 28 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ With SCX_OPS_ENQ_LAST, the last runnable task on a CPU is passed to ops.enqueue() instead of being kept running. Exiting tasks without SCX_OPS_ENQ_EXITING, migration disabled tasks without SCX_OPS_ENQ_MIGRATION_DISABLED and tasks on an offline rq skip ops.enqueue() and go straight to the local DSQ. This happens in put_prev_task_scx() after the pick has settled on idle, so nothing reschedules the CPU, which idles with the task queued until an unrelated wakeup lands on it or the watchdog fires. scx_mitosis, which sets SCX_OPS_ENQ_LAST without SCX_OPS_ENQ_EXITING, hit this during mass cgroup teardown: exiting tasks stuck in exit_mmap() for over 40 seconds. A task put on the local DSQ runs, as anywhere else. If the SCX_ENQ_LAST enqueue left the task on this CPU's local DSQ, set need_resched on the task being switched in, as proxy_resched_idle() does. resched_curr() would flag the task being put instead, and __schedule() clears that right after the pick.
Title sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-28T10:34:24.456Z

Reserved: 2026-09-25T10:25:14.391Z

Link: CVE-2026-99105

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T11:17:29.847

Modified: 2026-10-28T11:17:29.847

Link: CVE-2026-99105

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T12:30:16Z

Weaknesses

No weakness.