In the Linux kernel, the following vulnerability has been resolved: sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags… (CVE-2026-98463)

The Linux kernel scheduler's extended scheduling (sched_ext) code incorrectly derived the SCX_RQ_IN_WAKEUP flag from merged enqueue flags, including those stashed for remote activation. This caused move_remote_task_to_local_dsq() to set SCX_RQ_IN_WAKEUP on the destination runqueue even when no task_woken_scx() call followed, leading to deferred actions not being scheduled immediately. An immediate insert (IMMED) into a busy destination would request a local reenqueue that remained pending behind the running task. If the scheduler was disabled before deferred actions ran, the request could outlive the scheduler and reference freed per-CPU memory, causing a use-after-free. The patch corrects this by testing only the core enqueue flags for the wakeup bit, ensuring the proper wakeup path and task_woken_scx() call are followed.

This vulnerability can lead to a use-after-free condition in the Linux kernel scheduler's deferred action handling. Specifically, deferred actions may remain pending indefinitely and reference freed per-CPU memory if the scheduler is disabled before they run. This can cause kernel instability or crashes. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel update that includes this patch. Since this is a kernel-level issue, running updated kernel versions with the fix is the recommended mitigation.