---
id: CVE-2026-99269
title: 'sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs

  A task can be found on a non-local DSQ while the CPU which dispatched it
  is still running ops.deq…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d <
    cc2839946328c1618b3870d521b32bb9483d49d0
  - >-
    Linux >= ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d <
    2935062be77113c1c4565ca9d0c72180449aafee
  - Linux 7.1
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:14:42.052Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99269'
references:
  - url: 'https://git.kernel.org/stable/c/cc2839946328c1618b3870d521b32bb9483d49d0'
  - url: 'https://git.kernel.org/stable/c/2935062be77113c1c4565ca9d0c72180449aafee'
tags:
  - cve.org
epss: 0.00146
epssPercentile: 0.03862
ingestedAt: '2026-11-05T20:33:06.395Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs

A task can be found on a non-local DSQ while the CPU which dispatched it
is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING.
The DSQ consume and move paths don't wait for the dispatch to finish and
can operate on the task concurrently with the dispatcher.

Call scx_wait_dispatching() in scx_move_local_task_to_local_dsq(),
unlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they
operate on the task. In scx_move_local_task_to_local_dsq(), wait before
scx_resolve_local_dsq() as it may update p->scx.flags.

## Affected

- `Linux >= ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d < cc2839946328c1618b3870d521b32bb9483d49d0`
- `Linux >= ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d < 2935062be77113c1c4565ca9d0c72180449aafee`
- `Linux 7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.