CVE-2026-99104 (GCVE-0-2026-99104)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-28 10:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor
scx_bypass() claims bypass dispatch when the scheduler's depth goes from
zero to one and releases it when the depth returns to zero, but propagates
only the depth to the descendants, not the claim. A descendant that starts
bypassing with its ancestor never claims, and one whose own bypass ends
under the ancestor's keeps its claim, as its depth does not return to zero.
A sub-scheduler enable whose bypass ends under a PM suspend thus leaks its
claim: the parent keeps hosting bypass dispatch and the sub-scheduler's next
bypass trips the WARN_ON_ONCE() on the claim. A sub-scheduler disable that
starts under a PM suspend has no claim, so once the resume lifts the root's
bypass its tasks sit on the parent's bypass DSQs with nobody consuming them.
Claim for every descendant whose depth goes from zero to one in the
propagation and release every scheduler in the subtree whose depth returned
to zero once the tasks have moved out of the bypass DSQs. A parent that is
bypassing itself when a descendant claims consumes only its own bypass DSQs,
empty until it leaves bypass and becomes the host.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f0f18075e45d47bef7ff2eb9512ee4f0c7e5f9c7",
"status": "affected",
"version": "aa2a0a19686c90106ade6a7e848ffbb62d55d733",
"versionType": "git"
},
{
"lessThan": "5bdeca322a6f8d10acaf67cccab1f69747ee7be3",
"status": "affected",
"version": "aa2a0a19686c90106ade6a7e848ffbb62d55d733",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor\n\nscx_bypass() claims bypass dispatch when the scheduler\u0027s depth goes from\nzero to one and releases it when the depth returns to zero, but propagates\nonly the depth to the descendants, not the claim. A descendant that starts\nbypassing with its ancestor never claims, and one whose own bypass ends\nunder the ancestor\u0027s keeps its claim, as its depth does not return to zero.\n\nA sub-scheduler enable whose bypass ends under a PM suspend thus leaks its\nclaim: the parent keeps hosting bypass dispatch and the sub-scheduler\u0027s next\nbypass trips the WARN_ON_ONCE() on the claim. A sub-scheduler disable that\nstarts under a PM suspend has no claim, so once the resume lifts the root\u0027s\nbypass its tasks sit on the parent\u0027s bypass DSQs with nobody consuming them.\n\nClaim for every descendant whose depth goes from zero to one in the\npropagation and release every scheduler in the subtree whose depth returned\nto zero once the tasks have moved out of the bypass DSQs. A parent that is\nbypassing itself when a descendant claims consumes only its own bypass DSQs,\nempty until it leaves bypass and becomes the host."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:34:23.729Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f0f18075e45d47bef7ff2eb9512ee4f0c7e5f9c7"
},
{
"url": "https://git.kernel.org/stable/c/5bdeca322a6f8d10acaf67cccab1f69747ee7be3"
}
],
"title": "sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99104",
"datePublished": "2026-10-28T10:34:23.729Z",
"dateReserved": "2026-09-25T10:25:14.391Z",
"dateUpdated": "2026-10-28T10:34:23.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…