Linux kernel sched_ext: BUG_ON panic when a DSQ is destroyed before a deferred re-enqueue runs

Impact

scx_bpf_dsq_reenq() queues deferred work that runs later from run_deferred(), and destroy_dsq() does not flush those pending items. If the DSQ goes away first, process_deferred_reenq_users() sees SCX_DSQ_INVALID and hits a BUG_ON, panicking the host. This only matters on nodes running a sched_ext BPF scheduler that uses dsq_reenq and destroys DSQs at runtime - a growing pattern in GPU and HPC clusters that tune placement, but not a default configuration. Loading a sched_ext scheduler takes root, so the realistic failure is a self-inflicted panic from a scheduler reconfiguration rather than a tenant attack; the cost is still every job on the node.

Who can reach it

Local root, via a loaded sched_ext BPF scheduler that calls scx_bpf_dsq_reenq() and destroys DSQs. Not reachable by unprivileged users or tenants, and not reachable at all without CONFIG_SCHED_CLASS_EXT and a loaded scheduler.

What to do

Update to a kernel where process_deferred_reenq_users() reads dsq->id once with READ_ONCE() and skips a destroyed DSQ (two stable commits linked), then reboot the node. As an interim measure, avoid destroying DSQs at runtime in your scheduler, or fall back to the in-tree scheduler on affected nodes. No fixed release numbers appear in the record.

References

Related entries

• Linux kernel sched_ext: core-scheduling pick state corrupted when dispatch drops the rq lockCVE-2026-89517 · Linux kernel sched_ext (rq->core_pick and the keep-previous-task decision under core scheduling)Unscored
• Linux kernel sched_ext: deadlock and NULL deref when dispatch kfuncs assume the local rqCVE-2026-89518 · Linux kernel sched_ext dispatch kfuncs (this_rq() vs the dispatched rq under core scheduling)Unscored
• Linux kernel sched/core: core-scheduling selection corrupted by lock-dropping picks and concurrent flipsCVE-2026-89520 · Linux kernel sched/core (core-scheduling selection vs a pick_task() that releases the rq lock)Unscored
• Linux kernel SUNRPC: use-after-free of the lower transport when a TLS handshake cancel races completionCVE-2026-89536 · Linux kernel SUNRPC (client-side TLS handshake, xs_tls_handshake_sync)Unscored
• Linux kernel SUNRPC: short Kerberos MIC tokens read past a slab allocation on the RPC client and serverCVE-2026-89537 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_verify_mic_v2 token length check)Unscored
• Linux kernel SUNRPC: oversized krb5 wrap-token ec field leaves the receive xdr_buf in an inconsistent stateCVE-2026-89538 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_unwrap_v2, extra-count field)Unscored