{"cve":"CVE-2026-98865","nvd":{"published":"2026-10-18T16:17:40.973","modified":"2026-10-19T10:19:50.563","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Don't run ops.dequeue() with a DSQ lock held\n\nops.dequeue() is invoked with the source user DSQ's lock still held on\nthe consume and move paths (scx_consume_dispatch_q(),\nmove_task_between_dsqs()). A BPF scheduler which locks the source user\nDSQ from ops.dequeue() - e.g. by iterating it with bpf_iter_scx_dsq -\nself-deadlocks.\n\nops.dequeue() can only call the \"any\" kfuncs and none of them can lock a\nbuiltin DSQ, so the global and bypass paths can't deadlock; however,\nall DSQ locks share one lockdep class, so iterating any user DSQ from\nops.dequeue() on those paths trips the recursion check.\n\nMove the invocation after the DSQ unlock on all three paths.\nSCX_TASK_IN_CUSTODY is cleared under the lock serializing the transfer\nso that the callback is invoked exactly once.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/cb86607ada73185f321baa7f9d94a08a3a40bbf5","https://git.kernel.org/stable/c/fe499ae9da46e297f578d4346c4c8e338c3118db"],"products":[],"source":"nvd","synced_at":"2026-10-19T23:00:53.604569364+00:00"},"epss":{"cve":"CVE-2026-98865","score":0.00169,"percentile":0.06176,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}