PT-2026-136105

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the sched ext scheduler subsystem, a race condition exists where tasks can be moved between dispatch queues DSQs while the dispatching CPU is still executing operations. Specifically,...

PT-2026-128097

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scx bypass claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the depth returns to zero, but propagates onl...

PT-2026-128098

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix stall when a task enqueued with SCX ENQ LAST lands back on its CPU's local DSQ With SCX OPS ENQ LAST, the last runnable task on a CPU is passed to ops.enqueue instead of being kept running. Exiting tasks without SC...

PT-2026-128137

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until run deferred takes it, and the RCU callback that fre...

PT-2026-122062

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in sched cpu wait empty until nothing else is left, and the only thing that wake...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix starvation of scxenable under fair-class saturation During scxenable, the READY - ENABLED task switching loop changes the calling thread’s schedclass from fair to ext. Since fair has higher priority than ext,...

PT-2026-116682

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sched ext component where schedule deferred locked skips scheduling a deferred action when the SCX RQ IN WAKEUP flag is set. The enqueue task scx function sets thi...

PT-2026-117083

In the Linux kernel, the following vulnerability has been resolved: sched ext: Wait for SCX OPSS DISPATCHING before reenqueueing a task ebf1ccff79c4 "sched ext: Fix ops.dequeue semantics" moved the final ops state store in scx dispatch enqueue after the DSQ unlock so that the custody update and...

PT-2026-117084

In the Linux kernel, the following vulnerability has been resolved: sched ext: Don't run ops.dequeue with a DSQ lock held ops.dequeue is invoked with the source user DSQ's lock still held on the consume and move paths scx consume dispatch q, move task between dsqs. A BPF scheduler which locks the...

PT-2026-106548

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the sched ext component where scx alloc and add sched publishes ops-priv before scx root enable workfn updates the state to SCX ENABLING. If an error is claime...

PT-2026-97887

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sched ext component where the kick sync wait bal cb function assumes it is executing on the runqueue's rq own CPU. Because the dispatch process can drop the rq loc...

PT-2026-90232

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sched ext component where the process deferred reenq users function can trigger a BUG ON a kernel panic when encountering a destroyed Dispatch Queue DSQ. This occu...

PT-2026-90233

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the core scheduling of the Linux kernel where the pick next task function can experience state corruption. This occurs when selections on the same core interleave due ...

PT-2026-79736

In the Linux kernel, the following vulnerability has been resolved: sched ext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scx link sched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs...

PT-2026-79598

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock can occur in the sched ext component when scx cgroup lock acquires a write-lock on scx cgroup ops rwsem before taking the cgroup lock. This sequence creates a circular...

CVE-2026-68421

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't warn on core-sched forced idle in putprevtaskscx putprevtaskscx warns when a runnable task drops to a lower schedclass without SCXOPSENQLAST, on the assumption that balanceone would have kept it running. Core...

CVE-2026-68094

In the Linux kernel, the following vulnerability has been resolved: schedext: Preserve rq tracking across local DSQ dispatch dispatchtolocaldsq can run from scxbpfdsqmovetolocal while ops.dispatch has recorded the current rq. Moving a task to a local DSQ may switch to the source or destination rq...

CVE-2026-68421

The CVE-2026-68421 entry concerns the Linux kernel sched_ext path. The issue arises when put_prev_task_scx() warns about a runnable task dropping to a lower sched_class without ENQ_LAST, due to core scheduling forcing idle via an SMT sibling’s core_pick path which bypasses balance_one(). The miti...

EUVD-2026-55607

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't warn on core-sched forced idle in putprevtaskscx putprevtaskscx warns when a runnable task drops to a lower schedclass without SCXOPSENQLAST, on the assumption that balanceone would have kept it running. Core...

EUVD-2026-55475

In the Linux kernel, the following vulnerability has been resolved: schedext: Preserve rq tracking across local DSQ dispatch dispatchtolocaldsq can run from scxbpfdsqmovetolocal while ops.dispatch has recorded the current rq. Moving a task to a local DSQ may switch to the source or destination rq...