7 matches found
CVE-2026-99144
In the Linux kernel, the following vulnerability has been resolved: s...
CVE-2026-99144 sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue
In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...
CVE-2026-99144 sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue
In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...
EUVD-2026-111896
In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...
CVE-2026-99144
The Linux kernel contains a use-after-free vulnerability within the sched_ext component. The issue occurs because a deferred reenqueue can read a freed user DSQ (Dispatcher Status Queue). Specifically, a request may remain on a CPU's deferred list until run_deferred() processes it; however, the R...
PT-2026-128137
In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until run deferred takes it, and the RCU callback that fre...
UBUNTU-CVE-2026-99144
In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...