CVE-2026-68094

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Preserve rq tracking across local DSQ dispatch

dispatch_to_local_dsq() can run from scx_bpf_dsq_move_to_local() while

ops.dispatch() has recorded the current rq. Moving a task to a local DSQ

may switch to the source or destination rq before synchronously invoking

ops.dequeue() through the following path:

SCX_CALL_OP(dispatch, rq)

ops.dispatch()

scx_bpf_dsq_move_to_local()

scx_flush_dispatch_buf()

finish_dispatch()

dispatch_to_local_dsq()

scx_dispatch_enqueue()

local_dsq_post_enq()

call_task_dequeue()

SCX_CALL_OP_TASK(dequeue, locked_rq, ...)

The nested callback saves the recorded rq and restores it on return. If

the rq tracking does not follow the lock switch, update_locked_rq() can

trigger the following lockdep assertion while restoring an rq which is

no longer held:

WARNING: kernel/sched/sch

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References