CVE-2026-98865: Linux kernel · sched_ext: Don't run ops.dequeue() with a DSQ lock held
Affects Linux kernelSource CVE Database V5
Not known to be exploited : upgrade to fe499ae9da46e297f578d4346c4c8e338c3118db or cb86607ada73185f321baa7f9d94a08a3a40bbf5 when convenient.
Data as of 26 Oct 2026, 09:41 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- Patch
- Available – fixed in fe499ae9da46e297f578d4346c4c8e338c3118db, cb86607ada73185f321baa7f9d94a08a3a40bbf5
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to fe499ae9da46e297f578d4346c4c8e338c3118db or cb86607ada73185f321baa7f9d94a08a3a40bbf5.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in the Linux kernel commits fe499ae9da46e297f578d4346c4c8e338c3118db and cb86607ada73185f321baa7f9d94a08a3a40bbf5. Users and administrators should update to a Linux kernel version including these commits or later to resolve the issue. No additional mitigation steps are required.
Description
A deadlock vulnerability in the Linux kernel scheduler extension (sched_ext) was fixed by ensuring ops.dequeue() is not called while holding a DSQ lock. Previously, invoking ops.dequeue() with the source user DSQ's lock held could cause self-deadlocks in BPF schedulers that lock the source user DSQ during iteration. The fix moves the ops.dequeue() call to after the DSQ unlock, preventing deadlocks and ensuring callbacks are invoked exactly once.