CVE-2026-68094

Received Received - Intake

Race Condition in Linux Kernel Sched Ext

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Preserve rq tracking across local DSQ dispatch dispatch_to_local_dsq() can run from scx_bpf_dsq_move_to_local() while ops.dispatch() has recorded the current rq. Moving a task to a local DSQ may switch to the source or destination rq before synchronously invoking ops.dequeue() through the following path: SCX_CALL_OP(dispatch, rq) ops.dispatch() scx_bpf_dsq_move_to_local() scx_flush_dispatch_buf() finish_dispatch() dispatch_to_local_dsq() scx_dispatch_enqueue() local_dsq_post_enq() call_task_dequeue() SCX_CALL_OP_TASK(dequeue, locked_rq, ...) The nested callback saves the recorded rq and restores it on return. If the rq tracking does not follow the lock switch, update_locked_rq() can trigger the following lockdep assertion while restoring an rq which is no longer held: WARNING: kernel/sched/sched.h:1641 at call_task_dequeue+0x160/0x170 Call Trace: scx_dispatch_enqueue+0x2b0/0x460 dispatch_to_local_dsq+0x138/0x230 scx_flush_dispatch_buf+0x1af/0x220 scx_bpf_dsq_move_to_local___v2+0xe2/0x1c0 bpf__sched_ext_ops_dispatch+0x4b/0xa7 do_pick_task_scx+0x3b6/0x910 __pick_next_task+0x105/0x1f0 __schedule+0x3e7/0x1980 Introduce switch_rq_lock() to update the tracking state together with each rq lock handoff. Use it in dispatch_to_local_dsq(), move_remote_task_to_local_dsq() and the in-balance paths of scx_dsq_move(), ensuring that scx_locked_rq() consistently refers to the rq whose lock is actually held throughout the lock dance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-31

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68094

EUVD

EUVD-2026-55475

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where incorrect runqueue (rq) tracking during task scheduling can lead to a lockdep assertion failure. The issue occurs when a task is moved to a local DSQ (dispatch queue) while the scheduler's rq tracking is not properly synchronized with the lock handoff, causing a mismatch between the recorded rq and the actual locked rq.

Detection Guidance

This vulnerability is specific to the Linux kernel's sched_ext subsystem and requires kernel-level detection. No standard network or system commands can directly detect it. Kernel lockdep warnings or kernel oops messages related to rq tracking may indicate exploitation. Check kernel logs for lockdep assertions or warnings about rq handling in sched_ext operations.

Impact Analysis

This vulnerability can cause kernel instability, including kernel warnings or crashes (kernel panic) due to the lockdep assertion failure. It may lead to system hangs or unexpected reboots, disrupting normal operations and potentially causing data loss or service interruptions.

Compliance Impact

This vulnerability is a Linux kernel scheduling issue that could lead to race conditions or improper task state handling. It does not directly impact data privacy or security controls required by GDPR or HIPAA. Compliance with these standards depends on broader system configurations and controls rather than this specific kernel scheduling behavior.

Mitigation Strategies

Apply the latest kernel patches or updates that include the fix for CVE-2026-68094. If using a custom or patched kernel, ensure the sched_ext subsystem includes the switch_rq_lock() implementation to preserve rq tracking during lock handoffs. Monitor kernel logs for lockdep warnings as a sign of potential exploitation.

Hi! I’m here to help you understand CVE-2026-68094. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70