Is CVE-2026-98865 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-98865 being exploited in the wild.

How severe is CVE-2026-98865?

Informational severity, published 18 October 2026.

Is there a fix for CVE-2026-98865?

Yes: fixed in Linux kernel stable versions v7.1+ (fixed in commit cb86607ada73185f321baa7f9d94a08a3a40bbf5 and backported to stable branches). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-98865 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-98865?

Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-98865: Linux kernel sched_ext deadlock in ops.dequeue() with DSQ lock

CVE-2026-98865 · Severity: info · Published 2026-10-18

The Linux kernel's sched_ext scheduler subsystem had a deadlock vulnerability where BPF scheduler callbacks could self-deadlock if they attempted to lock dispatch queues. The vulnerability affected systems running custom BPF schedulers that tried to iterate or lock dispatch queues within their dequeue operations, potentially causing system hangs or denial of service.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-98865 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-98865 being exploited in the wild.
How severe is CVE-2026-98865?: Informational severity, published 18 October 2026.
Which products and versions are affected?: Linux Kernel v7.1 and later.
Is there a fix for CVE-2026-98865?: Yes: fixed in Linux kernel stable versions v7.1+ (fixed in commit cb86607ada73185f321baa7f9d94a08a3a40bbf5 and backported to stable branches). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-98865 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-98865?: Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Linux kernel stable versions v7.1+ (fixed in commit cb86607ada73185f321baa7f9d94a08a3a40bbf5 and backported to stable branches)

Technical details

The ops.dequeue() callback was invoked while holding a dispatch queue (DSQ) lock on consume and move paths (scx_consume_dispatch_q() and move_task_between_dsqs()). A BPF scheduler iterating a user DSQ from ops.dequeue() via bpf_iter_scx_dsq would self-deadlock; though builtin DSQs are protected from recursion, shared lockdep classes caused false-positive recursion checks. The fix moves ops.dequeue() invocation after DSQ unlock on all three paths and clears SCX_TASK_IN_CUSTODY under the serializing lock to ensure the callback fires exactly once.

Affected products

Linux Linux kernel v7.1 and later

Timeline

2026-10-18: disclosed
2026-09-17: patched: Upstream fix committed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.