GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68094 (GCVE-0-2026-68094)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-08-17 04:58
VLAI
Title
sched_ext: Preserve rq tracking across local DSQ dispatch
Summary
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Preserve rq tracking across local DSQ dispatch dispatch_to_local_dsq() can run from scx_bpf_dsq_move_to_local() while ops.dispatch() has recorded the current rq. Moving a task to a local DSQ may switch to the source or destination rq before synchronously invoking ops.dequeue() through the following path: SCX_CALL_OP(dispatch, rq) ops.dispatch() scx_bpf_dsq_move_to_local() scx_flush_dispatch_buf() finish_dispatch() dispatch_to_local_dsq() scx_dispatch_enqueue() local_dsq_post_enq() call_task_dequeue() SCX_CALL_OP_TASK(dequeue, locked_rq, ...) The nested callback saves the recorded rq and restores it on return. If the rq tracking does not follow the lock switch, update_locked_rq() can trigger the following lockdep assertion while restoring an rq which is no longer held: WARNING: kernel/sched/sched.h:1641 at call_task_dequeue+0x160/0x170 Call Trace: scx_dispatch_enqueue+0x2b0/0x460 dispatch_to_local_dsq+0x138/0x230 scx_flush_dispatch_buf+0x1af/0x220 scx_bpf_dsq_move_to_local___v2+0xe2/0x1c0 bpf__sched_ext_ops_dispatch+0x4b/0xa7 do_pick_task_scx+0x3b6/0x910 __pick_next_task+0x105/0x1f0 __schedule+0x3e7/0x1980 Introduce switch_rq_lock() to update the tracking state together with each rq lock handoff. Use it in dispatch_to_local_dsq(), move_remote_task_to_local_dsq() and the in-balance paths of scx_dsq_move(), ensuring that scx_locked_rq() consistently refers to the rq whose lock is actually held throughout the lock dance.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7fb39e4eb4c3db52e4707a6a1cd45362f7e803f5 , < 97c09c9f5739b8757ee29dabb0af30069137e286 (git)
Affected: 7fb39e4eb4c3db52e4707a6a1cd45362f7e803f5 , < 18d62044cda7a2b40f59d910659c0b0d6accad37 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "97c09c9f5739b8757ee29dabb0af30069137e286",
              "status": "affected",
              "version": "7fb39e4eb4c3db52e4707a6a1cd45362f7e803f5",
              "versionType": "git"
            },
            {
              "lessThan": "18d62044cda7a2b40f59d910659c0b0d6accad37",
              "status": "affected",
              "version": "7fb39e4eb4c3db52e4707a6a1cd45362f7e803f5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Preserve rq tracking across local DSQ dispatch\n\ndispatch_to_local_dsq() can run from scx_bpf_dsq_move_to_local() while\nops.dispatch() has recorded the current rq. Moving a task to a local DSQ\nmay switch to the source or destination rq before synchronously invoking\nops.dequeue() through the following path:\n\n  SCX_CALL_OP(dispatch, rq)\n    ops.dispatch()\n      scx_bpf_dsq_move_to_local()\n        scx_flush_dispatch_buf()\n          finish_dispatch()\n            dispatch_to_local_dsq()\n              scx_dispatch_enqueue()\n                local_dsq_post_enq()\n                  call_task_dequeue()\n                    SCX_CALL_OP_TASK(dequeue, locked_rq, ...)\n\nThe nested callback saves the recorded rq and restores it on return. If\nthe rq tracking does not follow the lock switch, update_locked_rq() can\ntrigger the following lockdep assertion while restoring an rq which is\nno longer held:\n\n  WARNING: kernel/sched/sched.h:1641 at call_task_dequeue+0x160/0x170\n  Call Trace:\n    scx_dispatch_enqueue+0x2b0/0x460\n    dispatch_to_local_dsq+0x138/0x230\n    scx_flush_dispatch_buf+0x1af/0x220\n    scx_bpf_dsq_move_to_local___v2+0xe2/0x1c0\n    bpf__sched_ext_ops_dispatch+0x4b/0xa7\n    do_pick_task_scx+0x3b6/0x910\n    __pick_next_task+0x105/0x1f0\n    __schedule+0x3e7/0x1980\n\nIntroduce switch_rq_lock() to update the tracking state together with\neach rq lock handoff. Use it in dispatch_to_local_dsq(),\nmove_remote_task_to_local_dsq() and the in-balance paths of\nscx_dsq_move(), ensuring that scx_locked_rq() consistently refers to the\nrq whose lock is actually held throughout the lock dance."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:58:42.583Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/97c09c9f5739b8757ee29dabb0af30069137e286"
        },
        {
          "url": "https://git.kernel.org/stable/c/18d62044cda7a2b40f59d910659c0b0d6accad37"
        }
      ],
      "title": "sched_ext: Preserve rq tracking across local DSQ dispatch",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68094",
    "datePublished": "2026-08-10T11:58:07.086Z",
    "dateReserved": "2026-07-30T09:28:09.367Z",
    "dateUpdated": "2026-08-17T04:58:42.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68094",
      "date": "2026-09-11",
      "epss": "0.00155",
      "percentile": "0.05021"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68094\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:19:53.543\",\"lastModified\":\"2026-08-17T05:18:08.667\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched_ext: Preserve rq tracking across local DSQ dispatch\\n\\ndispatch_to_local_dsq() can run from scx_bpf_dsq_move_to_local() while\\nops.dispatch() has recorded the current rq. Moving a task to a local DSQ\\nmay switch to the source or destination rq before synchronously invoking\\nops.dequeue() through the following path:\\n\\n  SCX_CALL_OP(dispatch, rq)\\n    ops.dispatch()\\n      scx_bpf_dsq_move_to_local()\\n        scx_flush_dispatch_buf()\\n          finish_dispatch()\\n            dispatch_to_local_dsq()\\n              scx_dispatch_enqueue()\\n                local_dsq_post_enq()\\n                  call_task_dequeue()\\n                    SCX_CALL_OP_TASK(dequeue, locked_rq, ...)\\n\\nThe nested callback saves the recorded rq and restores it on return. If\\nthe rq tracking does not follow the lock switch, update_locked_rq() can\\ntrigger the following lockdep assertion while restoring an rq which is\\nno longer held:\\n\\n  WARNING: kernel/sched/sched.h:1641 at call_task_dequeue+0x160/0x170\\n  Call Trace:\\n    scx_dispatch_enqueue+0x2b0/0x460\\n    dispatch_to_local_dsq+0x138/0x230\\n    scx_flush_dispatch_buf+0x1af/0x220\\n    scx_bpf_dsq_move_to_local___v2+0xe2/0x1c0\\n    bpf__sched_ext_ops_dispatch+0x4b/0xa7\\n    do_pick_task_scx+0x3b6/0x910\\n    __pick_next_task+0x105/0x1f0\\n    __schedule+0x3e7/0x1980\\n\\nIntroduce switch_rq_lock() to update the tracking state together with\\neach rq lock handoff. Use it in dispatch_to_local_dsq(),\\nmove_remote_task_to_local_dsq() and the in-balance paths of\\nscx_dsq_move(), ensuring that scx_locked_rq() consistently refers to the\\nrq whose lock is actually held throughout the lock dance.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/sched/ext/ext.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7fb39e4eb4c3db52e4707a6a1cd45362f7e803f5\",\"lessThan\":\"97c09c9f5739b8757ee29dabb0af30069137e286\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7fb39e4eb4c3db52e4707a6a1cd45362f7e803f5\",\"lessThan\":\"18d62044cda7a2b40f59d910659c0b0d6accad37\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/sched/ext/ext.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/18d62044cda7a2b40f59d910659c0b0d6accad37\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/97c09c9f5739b8757ee29dabb0af30069137e286\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-11T13:30:00+00:00",
      "cve": "CVE-2026-68094",
      "id": "CVE-2026-68094",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sched_ext: Preserve rq tracking across local DSQ dispatch",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68094.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-11T23:48:36Z",
      "cve": "CVE-2026-68094",
      "id": "CVE-2026-68094",
      "initial_release_date": "2026-08-11T23:48:36Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68094",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68094.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.