CVE-2026-89516 sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users
A local attacker can trigger a kernel crash by destroying a dispatch queue while a deferred re-enqueue operation is pending.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89516?
CVE-2026-89516 is a denial of service vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users
scx_bpf_dsq_reenq() queues a deferred reenq (dru) that runs from run_deferred(), not ops.dispatch(). If the DSQ is destroyed before the dru runs, process_deferred_reenq_users() sees dsq->id == SCX_DSQ_INVALID and hits the BUG_ON. destroy_dsq() doesn't flush pending drus, so just skip.
tj: Read dsq->id once with READ_ONCE(). Reading it separately in the INVALID check and the BUG_ON would leave a window where destroy_dsq() can invalidate the id between the two reads and still trigger the BUG_ON.
Which versions are affected by CVE-2026-89516?
How do I fix CVE-2026-89516?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-89516 being exploited?
There is no known exploitation of CVE-2026-89516 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-89516, GHSA-99wv-m4hp-r266, UBUNTU-CVE-2026-89516.