CVE-2026-99144 (GCVE-0-2026-99144)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue
A deferred reenqueue can read a freed user DSQ. The request stays on its
CPU's deferred list until run_deferred() takes it, and the RCU callback that
frees the DSQ assumes that the grace period has flushed it, so exit_dsq()
checks the per-CPU node without the deferred list lock. A grace period waits
for readers in flight, not for a pending run_deferred(). A run_deferred()
which starts after the grace period began can detach the request right
before the callback looks and then read the freed DSQ's id.
Cancel the pending requests before the grace period instead. The irq work
that frees the DSQ unlinks every CPU's request under the per-CPU deferred
list lock, and schedule_dsq_reenq() ignores a new request under the same
lock once the id is invalid. Only a run_deferred() that started before the
grace period can hold a request, and it runs with IRQs disabled, so the
grace period waits for it and nothing touches the DSQ after the callback.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "633f586329bfd9843bf8acf86c95353f4c16e22d",
"status": "affected",
"version": "84b1a0ea0b7c23dec240783a592e480780efe459",
"versionType": "git"
},
{
"lessThan": "069403dff337feb192bfc70fb28ddc8a171e20c1",
"status": "affected",
"version": "84b1a0ea0b7c23dec240783a592e480780efe459",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue\n\nA deferred reenqueue can read a freed user DSQ. The request stays on its\nCPU\u0027s deferred list until run_deferred() takes it, and the RCU callback that\nfrees the DSQ assumes that the grace period has flushed it, so exit_dsq()\nchecks the per-CPU node without the deferred list lock. A grace period waits\nfor readers in flight, not for a pending run_deferred(). A run_deferred()\nwhich starts after the grace period began can detach the request right\nbefore the callback looks and then read the freed DSQ\u0027s id.\n\nCancel the pending requests before the grace period instead. The irq work\nthat frees the DSQ unlinks every CPU\u0027s request under the per-CPU deferred\nlist lock, and schedule_dsq_reenq() ignores a new request under the same\nlock once the id is invalid. Only a run_deferred() that started before the\ngrace period can hold a request, and it runs with IRQs disabled, so the\ngrace period waits for it and nothing touches the DSQ after the callback."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:00.602Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/633f586329bfd9843bf8acf86c95353f4c16e22d"
},
{
"url": "https://git.kernel.org/stable/c/069403dff337feb192bfc70fb28ddc8a171e20c1"
}
],
"title": "sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99144",
"datePublished": "2026-10-28T10:35:00.602Z",
"dateReserved": "2026-09-25T10:25:14.395Z",
"dateUpdated": "2026-10-28T10:35:00.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…