CVE-2026-89516
Low risk· EPSS 9%Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In the Linux kernel's sched_ext scheduler, scx_bpf_dsq_reenq() queues a deferred reenq (dru) that runs from run_deferred(), not ops.dispatch(). If the DSQ is destroyed before the dru runs, process_deferred_reenq_users() sees dsq->id == SCX_DSQ_INVALID and hits the BUG_ON. destroy_dsq() doesn't flush pending drus, so it should just skip.
Risk Assessment
This can cause a kernel crash (BUG_ON), leading to denial of service or system halt.
Recommendation
Update the Linux kernel to a version containing the fix that skips invalid DSQs in process_deferred_reenq_users() and reads dsq->id once with READ_ONCE(). Until then, avoid configurations using sched_ext with deferred DSQ reenqueues.
Other vulnerabilities in Linux kernel (sched_ext)
See all- CVE-2026-89519Low risk· EPSS 9%
In the Linux kernel's sched_ext scheduler, the SCX_RQ_BAL_KEEP flag tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while dispatches and picks pair up one to one, which core scheduling breaks: selections interleave through dispatch's lock drops and a pick can consume a stale flag, keeping a task that has since been dequeued.
- CVE-2025-68333Medium
In the Linux kernel sched_ext subsystem, a possible deadlock exists in deferred_irq_workfn() on PREEMPT_RT=y kernels. When the function runs in the per-CPU irq_work/* task context without interrupts disabled, an interrupt may re-acquire the same rq->__lock. The fix forces the function to always run in hard-irq context.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users scx_bpf_dsq_reenq() queues a deferred reenq (dru) that runs from run_deferred(), not ops.dispatch(). If the DSQ is destroyed before the dru runs, process_deferred_reenq_users() sees dsq->id == SCX_DSQ_INVALID and hits the BUG_ON. destroy_dsq() doesn't flush pending drus, so just skip. tj: Read dsq->id once with READ_ONCE(). Reading it separately in the INVALID check and the BUG_ON would leave a window where destroy_dsq() can invalidate the id between the two reads and still trigger the BUG_ON.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS