CVE-2026-89518
Description
A flaw was found in the Linux kernel's sched_ext component. Under core scheduling, incorrect assumptions in dispatch kfuncs regarding this_rq() can lead to a deadlock. This occurs when an rq lock is acquired on a CPU different from the dispatched rq's, potentially causing the system to become unresponsive. This vulnerability could result in a Denial of Service (DoS).
Statement
A moderate-impact denial of service flaw was found in the Linux kernel's sched_ext scheduler framework. Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling run queue (rq), so ops.dispatch() may execute on a CPU different from the dispatched rq's. Several sched_ext dispatch kfuncs incorrectly assumed the two always coincide: scx_dsq_move() could acquire the source rq lock while the dispatched rq lock was already held, resulting in a deadlock; scx_bpf_sub_dispatch() could dispatch this_rq() with a NULL sub_dispatch_prev; and finish_dispatch(), scx_bpf_dsq_reenq(), and scx_bpf_dsq_nr_queued() resolved SCX_DSQ_LOCAL to the executing CPU's local DSQ rather than the dispatched rq's. A local attacker able to run a sched_ext BPF scheduler on an affected kernel operating under core scheduling could trigger this deadlock and make the system unresponsive. Red Hat rated this flaw Moderate impact with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), affecting availability only. The vulnerable sched_ext dispatch kfunc code is not present in the kernel versions shipped in any Red Hat Enterprise Linux or Red Hat OpenShift (RHCOS) builds, so all Red Hat products are marked NOT AFFECTED for this CVE.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
