# CVE-2026-99144: sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 28 Oct 2026
- **Updated:** 28 Oct 2026
- **Also known as:** DEBIAN-CVE-2026-99144, GHSA-mqg8-58gq-6w7m, UBUNTU-CVE-2026-99144

## What is CVE-2026-99144?

CVE-2026-99144 is a vulnerability in Linux, published on 28 Oct 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue

A deferred reenqueue can read a freed user DSQ. The request stays on its
CPU's deferred list until run_deferred() takes it, and the RCU callback that
frees the DSQ assumes that the grace period has flushed it, so exit_dsq()
checks the per-CPU node without the deferred list lock. A grace period waits
for readers in flight, not for a pending run_deferred(). A run_deferred()
which starts after the grace period began can detach the request right
before the callback looks and then read the freed DSQ's id.

Cancel the pending requests before the grace period instead. The irq work
that frees the DSQ unlinks every CPU's request under the per-CPU deferred
list lock, and schedule_dsq_reenq() ignores a new request under the same
lock once the id is invalid. Only a run_deferred() that started before the
grace period can hold a request, and it runs with IRQs disabled, so the
grace period waits for it and nothing touches the DSQ after the callback.

## Which versions are affected by CVE-2026-99144?


## How do I fix CVE-2026-99144?

Upgrade to a fixed version.

## Is CVE-2026-99144 being exploited?

There is no known exploitation of CVE-2026-99144 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-99144 and fix it if it is affected.

What it is: CVE-2026-99144 is a vulnerability in Linux, published on 28 Oct 2026. 
Exploitation: There is no known exploitation of CVE-2026-99144 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-99144/ (Markdown: https://insights.sbomify.com/CVE-2026-99144/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-99144
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-99144
- OSV: https://osv.dev/vulnerability/CVE-2026-99144

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-99144/
Summaries are generated and may contain mistakes; the official description above is the record.