{"id":"CVE-2026-98865","revision":"84cb2c359b4047ea821166409be08a92","records":[{"revision":"84cb2c359b4047ea821166409be08a92","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98865","aliases":[],"title":"sched_ext: Don't run ops.dequeue() with a DSQ lock held","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Don't run ops.dequeue() with a DSQ lock held\n\nops.dequeue() is invoked with the source user DSQ's lock still held on\nthe consume and move paths (scx_consume_dispatch_q(),\nmove_task_between_dsqs()). A BPF scheduler which locks the source user\nDSQ from ops.dequeue() - e.g. by iterating it with bpf_iter_scx_dsq -\nself-deadlocks.\n\nops.dequeue() can only call the \"any\" kfuncs and none of them can lock a\nbuiltin DSQ, so the global and bypass paths can't deadlock; however,\nall DSQ locks share one lockdep class, so iterating any user DSQ from\nops.dequeue() on those paths trips the recursion check.\n\nMove the invocation after the DSQ unlock on all three paths.\nSCX_TASK_IN_CUSTODY is cleared under the lock serializing the transfer\nso that the callback is invoked exactly once.","state":0,"publishedAt":"2026-10-18T15:51:26.449+00:00","modifiedAt":"2026-10-19T09:26:59.604+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/sched/ext/ext.c\",\n                        \"kernel/sched/ext/internal.h\",\n                        \"kernel/sched/ext/sub.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d\",\n                            \"lessThan\": \"fe499ae9da46e297f578d4346c4c8e338c3118db\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d\",\n                            \"lessThan\": \"cb86607ada73185f321baa7f9d94a08a3a40bbf5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/sched/ext/ext.c\",\n                        \"kernel/sched/ext/internal.h\",\n                        \"kernel/sched/ext/sub.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.10\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/fe499ae9da46e297f578d4346c4c8e338c3118db","https://git.kernel.org/stable/c/cb86607ada73185f321baa7f9d94a08a3a40bbf5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98865","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98865","identifiers":["CVE-2026-98865"]},"retained":false,"historicalAffected":[]}],"coverage":[]}