The Linux kernel vulnerability (CVE-2026-89518) involved the sched_ext subsystem's dispatch kernel functions incorrectly assuming that the CPU runqueue (rq) used in dispatch operations is always the current CPU's rq. Under core scheduling, dispatch can occur on sibling CPUs, causing several functions (scx_dsq_move, scx_bpf_sub_dispatch, finish_dispatch, scx_bpf_dsq_reenq, scx_bpf_dsq_nr_queued) to behave incorrectly, potentially leading to deadlocks due to improper locking and null pointer dereferences. The fix involved using the rq tracked by scx_locked_rq(), which correctly references the dispatched rq during operations, ensuring proper locking and behavior regardless of the CPU executing the dispatch.

The vulnerability could cause deadlocks in the kernel scheduler due to improper locking when dispatching on sibling CPUs, potentially affecting system stability and scheduling correctness. There is no indication of exploitation in the wild or direct security compromise, but the issue affects kernel core scheduling reliability.

A fix has been implemented in the Linux kernel to address this issue by correcting the rq assumptions in dispatch kernel functions. Users should apply the official kernel updates that include this fix. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or official kernel repositories for the patch and update accordingly.