CVE-2026-89516

Received Received - Intake

Kernel BUG in Sched Ext Due to DSQ Destruction

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users scx_bpf_dsq_reenq() queues a deferred reenq (dru) that runs from run_deferred(), not ops.dispatch(). If the DSQ is destroyed before the dru runs, process_deferred_reenq_users() sees dsq->id == SCX_DSQ_INVALID and hits the BUG_ON. destroy_dsq() doesn't flush pending drus, so just skip. tj: Read dsq->id once with READ_ONCE(). Reading it separately in the INVALID check and the BUG_ON would leave a window where destroy_dsq() can invalidate the id between the two reads and still trigger the BUG_ON.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89516

EUVD

EUVD-2026-76422

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a bug check (BUG_ON) could be triggered if a deferred reenqueue operation runs on a destroyed data structure queue (DSQ). The issue occurs because the destroy operation does not wait for pending reenqueue operations to complete, potentially leading to a system crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's sched_ext subsystem and requires kernel-level detection methods. Check kernel logs for BUG_ON errors related to DSQ destruction or scx_bpf_dsq_reenq. Use commands like dmesg | grep -i 'BUG_ON\|DSQ\|scx_bpf' to search for related errors.

Impact Analysis

This vulnerability could cause a kernel panic or system crash if exploited, leading to denial of service. It primarily affects systems using the sched_ext feature with BPF-based task scheduling.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel bug related to scheduler operations and does not involve data exposure or privacy violations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel logs for any signs of exploitation or related errors. If using sched_ext features, ensure proper cleanup of DSQs to avoid deferred reenq issues.

Hi! I’m here to help you understand CVE-2026-89516. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70