VulnerabilityPublished 28 Oct 2026

CVE-2026-99144: Linux kernel · sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue

Source GCVE Database

Authoritative record:CVE-2026-99144

Not known to be exploited : upgrade to 069403dff337feb192bfc70fb28ddc8a171e20c1 or 633f586329bfd9843bf8acf86c95353f4c16e22d when convenient.

Data as of 28 Oct 2026, 14:01 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Patch: Available – fixed in 069403dff337feb192bfc70fb28ddc8a171e20c1, 633f586329bfd9843bf8acf86c95353f4c16e22d

Exploitation evidence

Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-mqg8-58gq-6w7m

What to do

Upgrade Linux kernel to 069403dff337feb192bfc70fb28ddc8a171e20c1 or 633f586329bfd9843bf8acf86c95353f4c16e22d.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 84b1a0ea0b7c23dec240783a592e480780efe459, < 069403dff337feb192bfc70fb28ddc8a171e20c1	Fixed in 069403dff337feb192bfc70fb28ddc8a171e20c1
LinuxLinux	Affected ≥ 84b1a0ea0b7c23dec240783a592e480780efe459, < 633f586329bfd9843bf8acf86c95353f4c16e22d	Fixed in 633f586329bfd9843bf8acf86c95353f4c16e22d
LinuxLinux	Affected =7.1	Fixed in–
Red Hatredhat/kernel`pkg:rpm/redhat/kernel`Other threats	Affected =7.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

The vulnerability has been resolved in the Linux kernel by implementing proper cancellation of pending requests before the grace period and ensuring safe unlinking of requests under locks. Users should apply the official Linux kernel updates that include this fix. No additional mitigation is indicated.

Description

A use-after-free vulnerability in the Linux kernel's sched_ext subsystem was fixed. The flaw involved a deferred reenqueue operation that could access a destroyed user Deferred Scheduling Queue (DSQ) after it was freed. This occurred because the grace period mechanism did not wait for pending deferred reenqueue operations, allowing a race condition where freed memory could be accessed.

Impact

The vulnerability could allow kernel code to access freed memory, potentially leading to undefined behavior such as system crashes or memory corruption. However, there is no indication of known exploitation in the wild or direct impact on confidentiality, integrity, or availability beyond the use-after-free condition.

Summary

CVE-2026-99144 addresses a use-after-free vulnerability in the Linux kernel's sched_ext component. The issue arises when a deferred reenqueue operation reads a user DSQ that has already been freed. The request remains on the CPU's deferred list until processed by run_deferred(), but the RCU callback that frees the DSQ assumes the grace period has completed and does not account for pending deferred reenqueue operations. This leads to a race condition where run_deferred() can detach a request just before the callback inspects it, resulting in access to freed memory. The fix involves canceling pending requests before the grace period, ensuring that the irq work freeing the DSQ unlinks all CPU requests under proper locking, and that schedule_dsq_reenq() ignores new requests with invalid IDs. This guarantees that only run_deferred() operations started before the grace period can hold requests, and these run with IRQs disabled, ensuring safe memory access.

References

Community reviews

Loading reviews…