Linux kernel sched_ext: deadlock and NULL deref when dispatch kfuncs assume the local rq

Impact

Under core scheduling, dispatch runs inside the core-wide pick and can target a sibling rq, so the CPU executing ops.dispatch() is not necessarily the dispatched rq's CPU. Several kfuncs assumed they were the same: scx_dsq_move() decided lock state from this_rq()'s flags and could take the source rq lock on top of an already-held dispatched rq lock, which can deadlock the host; scx_bpf_sub_dispatch() used a stashed sub_dispatch_prev that is NULL when dispatching for a sibling; and finish_dispatch(), scx_bpf_dsq_reenq() and scx_bpf_dsq_nr_queued() resolved SCX_DSQ_LOCAL to the wrong local DSQ, putting tasks on the wrong queue. A deadlocked rq on a GPU node is an unplanned loss of the whole node, and the SCX_DSQ_LOCAL resolution change also alters behaviour without core scheduling (a remote wakeup in ops.enqueue() now resolves to the op's rq), so scheduler authors should read the change rather than just take the patch.

Who can reach it

Local, limited to nodes running a sched_ext BPF scheduler that uses these kfuncs, primarily with core scheduling enabled. Loading the scheduler requires root; after that the faulty paths are hit by ordinary scheduling activity.

What to do

Update to a kernel where these kfuncs use scx_locked_rq() instead of this_rq() (two stable commits linked) and reboot each node. Disabling core scheduling, or unloading the sched_ext scheduler, avoids the sibling-dispatch case in the meantime. No fixed release numbers are stated in the record.

References

Related entries

• Linux kernel sched/core: core-scheduling selection corrupted by lock-dropping picks and concurrent flipsCVE-2026-89520 · Linux kernel sched/core (core-scheduling selection vs a pick_task() that releases the rq lock)Unscored
• Linux kernel SUNRPC: use-after-free of the lower transport when a TLS handshake cancel races completionCVE-2026-89536 · Linux kernel SUNRPC (client-side TLS handshake, xs_tls_handshake_sync)Unscored
• Linux kernel SUNRPC: short Kerberos MIC tokens read past a slab allocation on the RPC client and serverCVE-2026-89537 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_verify_mic_v2 token length check)Unscored
• Linux kernel SUNRPC: oversized krb5 wrap-token ec field leaves the receive xdr_buf in an inconsistent stateCVE-2026-89538 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_unwrap_v2, extra-count field)Unscored
• Linux kernel SUNRPC: integer overflow in krb5p reply length check lets a hostile NFS server drive OOB readsCVE-2026-89541 · Linux kernel SUNRPC (gss_unwrap_resp_priv RPCSEC_GSS opaque length check)Unscored
• Linux kernel SUNRPC: short krb5 wrap tokens cause OOB reads, a divide-by-zero and a huge memmoveCVE-2026-89542 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_unwrap_v2 and rotate_left short-token handling)Unscored