CVE-2026-98864 sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task
A race condition in the Linux kernel scheduler allows tasks to be dropped during reenqueueing, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98864?
CVE-2026-98864 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task
ebf1ccff79c4 ("sched_ext: Fix ops.dequeue() semantics") moved the final ops_state store in scx_dispatch_enqueue() after the DSQ unlock so that the custody update and ops.dequeue() precede it. A task can thus be found on a DSQ while still SCX_OPSS_DISPATCHING.
The dequeue and core-sched pick paths wait for the state to clear in ops_dequeue() but the reenqueue paths don't. A reenqueue in that window runs ops.enqueue() and sets SCX_OPSS_QUEUED before the dispatch has completed. The dispatcher's final store then overwrites it with SCX_OPSS_NONE and finish_dispatch() drops every later dispatch of the task.
Wait for SCX_OPSS_DISPATCHING to clear before dequeueing a task for reenqueue, the same way ops_dequeue() does.
Which versions are affected by CVE-2026-98864?
How do I fix CVE-2026-98864?
Apply the vendor's patch.
Is CVE-2026-98864 being exploited?
There is no known exploitation of CVE-2026-98864 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-98864, GHSA-fpjr-j5w9-j6gm, UBUNTU-CVE-2026-98864.