Executive brief
The Linux kernel's extended scheduler module can crash when a deferred task re-enqueueing operation races with the destruction of its associated dispatch queue. An attacker or faulty workload can trigger this kernel panic by destroying a dispatch queue while a pending re-enqueueing operation is still pending, causing a denial of service by crashing the system.
Technical details
This is a race condition vulnerability in the kernel/sched/ext/ext.c module within the sched_ext (extended scheduler) subsystem. The scx_bpf_dsq_reenq() function queues a deferred re-enqueueing operation (dru) that runs asynchronously via run_deferred() rather than during dispatch. When destroy_dsq() invalidates a dispatch queue before the pending dru executes, process_deferred_reenq_users() reads an SCX_DSQ_INVALID id but still triggers a BUG_ON assertion, causing a kernel panic. The fix checks if the dsq->id has been invalidated (using READ_ONCE() to prevent TOCTOU race) and skips re-enqueueing for destroyed queues rather than panicking. The vulnerability affects kernel v7.1 and later where scx_bpf_dsq_reenq() was introduced.
Affected products
- Linux Linux Kernel v7.1+
Timeline
- 2026-09-11: disclosed
- 2026-08-14: patched