Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-99269— sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： sched_ext：在将任务从 DSQ（调度器队列）移出之前，需等待 SCX_OPSS_DISPATCHING 标志被清除。当某个 CPU 正在执行 ops.dequeue() 且尚未清除 SCX_OPSS_DISPATCHING 标志时，该 CPU 所调度的任务仍可能出现在非本地 DSQ 中。DSQ 的消耗（consume）和迁移（move）路径未等待调度操作完成，导致它们可能与调度器并发操作该任务，从而引发竞态条件。修复方法是在以下函数中、在对任务执行操作之前，

CVSS 7.8 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1212 · Exploitation for Credential Access T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 6

Vendor	Product	Version Range	Status
Linux	Linux	`ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d< cc2839946328c1618b3870d521b32bb9483d49d0`	affected
		`ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d< 2935062be77113c1c4565ca9d0c72180449aafee`	affected
		`7.1`	affected
		`< 7.1`	unaffected
		`7.2.14≤ 7.2.*`	unaffected
		`7.3≤ *`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING. The DSQ consume and move paths don't wait for the dispatch to finish and can operate on the task concurrently with the dispatcher. Call scx_wait_dispatching() in scx_move_local_task_to_local_dsq(), unlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they operate on the task. In scx_move_local_task_to_local_dsq(), wait before scx_resolve_local_dsq() as it may update p->scx.flags.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d ~ cc2839946328c1618b3870d521b32bb9483d49d0	-
Linux	Linux	7.1	-

II. Public POCs for CVE-2026-99269

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99269

请登录查看更多情报信息。

Other References for CVE-2026-99269 (2)

https://www.cve.org/CVERecord?id=CVE-2026-99269

Same Patch Batch · Linux · 2026-11-03 · 28 CVEs total

CVE-2026-99246	8.1 HIGH	tipc: protect node reset trace dump with node lock
CVE-2026-99270	8.1 HIGH	tcp: Fix potential UAF in reqsk_timer_handler().
CVE-2026-99264	7.8 HIGH	io_uring/net: don't retry recv on uncommitted buffers
CVE-2026-99257		gpio: shared: gracefully handle no-device lookup of shared GPIOs
CVE-2026-99243		io-wq: order the exit bit against worker creation task work
CVE-2026-99245		KEYS: Fix key_reject_and_link() race with keyring restriction
CVE-2026-99244		pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
CVE-2026-99248		i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
CVE-2026-99247		tracing: Do not initialize tracefs work if tracing is disabled
CVE-2026-99249		pid_namespace: make zap_pid_ns_processes() freezable
CVE-2026-99250		printk: Postpone kthread startup
CVE-2026-99251		Drivers: hv: Avoid infinite retry loop in init_vp_index()
CVE-2026-99252		io_uring/mpscq: disable preemption while pushing
CVE-2026-99253		io_uring/cancel: rearm local work wake up before sleep
CVE-2026-99255		io_uring/io-wq: don't hide a link from cancellations
CVE-2026-99254		io_uring: don't flood a cancelling task with task_work
CVE-2026-99256		dm cache: fix issue with background work locking
CVE-2026-99259		soc/tegra: pmc: Fix uninitialised clock rate
CVE-2026-99258		x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
CVE-2026-99260		ntfs: fix resident conversion in ntfs_new_attr_flags

Showing top 20 of 28 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux