Linux kernel sched_ext: DSQ consume and move paths operate on a task still being dispatched

Impact

A task can sit on a non-local dispatch queue while the CPU that dispatched it is still inside ops.dequeue() with SCX_OPSS_DISPATCHING set. The consume and move paths did not wait for that dispatch to finish, so they manipulate the task concurrently with the dispatcher, including in scx_resolve_local_dsq() which may update p->scx.flags. The fix adds scx_wait_dispatching() calls before those operations. Reachable only where a BPF scheduler is actually loaded through sched_ext - clusters using a custom scheduler for GPU job placement or latency isolation. On a stock CONFIG_SCHED_CLASS_EXT kernel with no BPF scheduler attached, the code path is not exercised, so most fleets are unaffected in practice; loading a sched_ext scheduler already requires privilege, which limits this to a stability and correctness fix for those who do.

Who can reach it

Local, and only on a node running a loaded sched_ext BPF scheduler; triggering the race requires workload timing against a dispatching CPU rather than any special permission. Attaching a sched_ext scheduler in the first place needs CAP_BPF/CAP_SYS_ADMIN.

What to do

Take the two stable kernel commits in the advisory, or a distro kernel that includes them, and reboot the affected nodes - a kernel scheduler core change cannot be hot-patched here. Clusters that do not load a sched_ext BPF scheduler can treat this as routine and fold it into the next scheduled kernel roll.

References

Related entries

• xrdp: out-of-bounds read parsing Confirm Active PDU crashes the server or leaks process memoryCVE-2026-33516 · xrdp (RDP capability exchange, Confirm Active PDU parsing)High
• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
• VMware Tools for Windows: improper authorisation lets a guest user reach other guest VMs on the same vCenter or ESXCVE-2025-41246 · VMware Tools for Windows (guest access control)High
• Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough): Buffer overflow on the MSI-X table write pathCVE-2015-8554 · Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough)High
• Linux kernel RDS net/rds/recv.c - rds_inc_info_copy: A structure member is left uninitialised before the RDS messageCVE-2016-5244 · Linux kernel RDS net/rds/recv.c - rds_inc_info_copyHigh