https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 12:35:27 +0000 https://db.gcve.eu/vuln/cve-2026-98865 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>sched_ext: Don&#39;t run ops.dequeue() with a DSQ lock held</p> <p>ops.dequeue() is invoked with the source user DSQ&#39;s lock still held on the consume and move paths (scx_consume_dispatch_q(), move_task_between_dsqs()). A BPF scheduler which locks the source user DSQ from ops.dequeue() - e.g. by iterating it with bpf_iter_scx_dsq - self-deadlocks.</p> <p>ops.dequeue() can only call the &#34;any&#34; kfuncs and none of them can lock a builtin DSQ, so the global and bypass paths can&#39;t deadlock; however, all DSQ locks share one lockdep class, so iterating any user DSQ from ops.dequeue() on those paths trips the recursion check.</p> <p>Move the invocation after the DSQ unlock on all three paths. SCX_TASK_IN_CUSTODY is cleared under the lock serializing the transfer so that the callback is invoked exactly once.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>sched_ext: Don&#39;t run ops.dequeue() with a DSQ lock held</p> <p>ops.dequeue() is invoked with the source user DSQ&#39;s lock still held on the consume and move paths (scx_consume_dispatch_q(), move_task_between_dsqs()). A BPF scheduler which locks the source user DSQ from ops.dequeue() - e.g. by iterating it with bpf_iter_scx_dsq - self-deadlocks.</p> <p>ops.dequeue() can only call the &#34;any&#34; kfuncs and none of them can lock a builtin DSQ, so the global and bypass paths can&#39;t deadlock; however, all DSQ locks share one lockdep class, so iterating any user DSQ from ops.dequeue() on those paths trips the recursion check.</p> <p>Move the invocation after the DSQ unlock on all three paths. SCX_TASK_IN_CUSTODY is cleared under the lock serializing the transfer so that the callback is invoked exactly once.</p> https://db.gcve.eu/vuln/cve-2026-98865