VulnerabilityPublished 3 Nov 2026

CVE-2026-99269: Linux kernel · sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs

Source GCVE Database

Authoritative record:CVE-2026-99269· Medium

Not known to be exploited : upgrade to cc2839946328c1618b3870d521b32bb9483d49d0 or 2935062be77113c1c4565ca9d0c72180449aafee when convenient.

Data as of 3 Nov 2026, 13:15 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in cc2839946328c1618b3870d521b32bb9483d49d0, 2935062be77113c1c4565ca9d0c72180449aafee

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 3 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-mv2r-pvjc-x9r3

What to do

Upgrade Linux kernel to cc2839946328c1618b3870d521b32bb9483d49d0 or 2935062be77113c1c4565ca9d0c72180449aafee.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d, < cc2839946328c1618b3870d521b32bb9483d49d0	Fixed in cc2839946328c1618b3870d521b32bb9483d49d0
LinuxLinux	Affected ≥ ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d, < 2935062be77113c1c4565ca9d0c72180449aafee	Fixed in 2935062be77113c1c4565ca9d0c72180449aafee
LinuxLinux	Affected =7.1	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel by adding synchronization calls (scx_wait_dispatching()) in relevant functions to wait for dispatch completion before moving tasks off DSQs. Users should update to the patched kernel version once available. No additional mitigation guidance is provided.

Description

A concurrency issue in the Linux kernel scheduler extension (sched_ext) was resolved by ensuring that operations moving tasks off dispatch queues (DSQs) wait for the dispatching process to complete. This prevents concurrent operations on the same task that could lead to inconsistent task state.

Impact

The vulnerability could lead to concurrent operations on the same task within the scheduler, potentially causing inconsistent task state or scheduler instability. No specific exploitation or impact details such as privilege escalation or denial of service are provided.

Summary

CVE-2026-99269 addresses a race condition in the Linux kernel's sched_ext component where a task may be concurrently accessed by the dispatcher and the DSQ consume and move paths. The vulnerability arises because these paths do not wait for the SCX_OPSS_DISPATCHING flag to clear before operating on the task, potentially causing concurrent modifications. The fix involves calling scx_wait_dispatching() in key functions that move tasks between DSQs to ensure the dispatching operation completes before further task manipulation.

References

Community reviews

Loading reviews…