CVE-2026-68094: Linux Kernel Privilege Escalation Flaw

CVE-2026-68094 Overview

CVE-2026-68094 is a Linux kernel vulnerability in the sched_ext (extensible scheduler class) subsystem. The flaw involves inconsistent runqueue (rq) tracking when dispatch_to_local_dsq() runs from scx_bpf_dsq_move_to_local() while ops.dispatch() has recorded the current rq. When a task moves to a local dispatch queue (DSQ), the kernel may switch to the source or destination rq before invoking ops.dequeue(). The nested callback saves and restores the recorded rq, and if the tracking does not follow the lock switch, update_locked_rq() triggers a lockdep assertion at kernel/sched/sched.h:1641.

Critical Impact
The bug triggers a kernel warning and lockdep assertion, potentially destabilizing scheduling on systems using BPF-based sched_ext schedulers.

Affected Products

Linux kernel builds with CONFIG_SCHED_CLASS_EXT enabled
Systems running BPF schedulers that call scx_bpf_dsq_move_to_local()
Distributions shipping the sched_ext framework prior to the fix

Discovery Timeline

2026-08-10 - CVE-2026-68094 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68094

Vulnerability Analysis

The defect resides in the sched_ext scheduler class, which allows BPF programs to implement custom scheduling policies. When a BPF ops.dispatch() callback moves a task into a local DSQ via scx_bpf_dsq_move_to_local(), the dispatch path calls scx_flush_dispatch_buf() → finish_dispatch() → dispatch_to_local_dsq(). This chain can switch the currently locked rq to either the source or destination rq before synchronously invoking ops.dequeue() through call_task_dequeue().

The nested SCX_CALL_OP_TASK(dequeue, locked_rq, ...) saves the recorded rq and restores it on return. If the tracking state does not mirror the actual lock handoff, the restore step references an rq whose lock is no longer held. This produces the observed lockdep warning in scx_dispatch_enqueue+0x2b0/0x460.

Root Cause

The root cause is a state-tracking inconsistency between the recorded scx_locked_rq() value and the rq lock actually held during dispatch operations. Lock ownership transitions during local DSQ dispatch do not update the tracking variable, which breaks invariants that update_locked_rq() enforces.

Attack Vector

The issue is triggered by legitimate BPF sched_ext programs performing local DSQ dispatches. There is no known remote or unauthenticated attack path. Triggering the warning requires the ability to load a sched_ext BPF scheduler, which is typically restricted to privileged users. See the Kernel Patch 18d62044 and Kernel Patch 97c09c9f for technical details.

The fix introduces switch_rq_lock() to update the tracking state together with each rq lock handoff. It is applied in dispatch_to_local_dsq(), move_remote_task_to_local_dsq(), and the in-balance paths of scx_dsq_move(), ensuring scx_locked_rq() consistently reflects the rq whose lock is held.

Detection Methods for CVE-2026-68094

Indicators of Compromise

Kernel log entries containing WARNING: kernel/sched/sched.h:1641 at call_task_dequeue
Stack traces including scx_dispatch_enqueue, dispatch_to_local_dsq, and scx_bpf_dsq_move_to_local___v2
Lockdep assertions triggered during __pick_next_task scheduling paths on hosts running BPF schedulers

Detection Strategies

Monitor dmesg and journalctl -k for lockdep warnings originating in sched_ext code paths
Inventory hosts that load sched_ext BPF programs using bpftool prog list and correlate with kernel versions
Track kernel version and configuration to identify systems built with CONFIG_SCHED_CLASS_EXT=y that have not received the patched commits

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on sched_ext warning signatures
Track BPF program load events to identify introduction of custom schedulers
Baseline scheduler behavior and alert on unexpected task dequeue anomalies on production hosts

How to Mitigate CVE-2026-68094

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 18d62044 and 97c09c9f or upgrade to a stable kernel release containing them
Audit which systems load sched_ext BPF schedulers and prioritize patching those hosts
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted administrators to limit who can load custom schedulers

Patch Information

Upstream fixes are available as Kernel Patch 18d62044 and Kernel Patch 97c09c9f. Both patches introduce switch_rq_lock() and update the affected dispatch paths so scx_locked_rq() mirrors the held rq lock across transitions.

Workarounds

Disable sched_ext by unloading any active BPF scheduler with scx_loader or the scheduler's userspace controller
Build kernels without CONFIG_SCHED_CLASS_EXT where custom BPF scheduling is not required
Revert to the default CFS/EEVDF scheduler on affected hosts until patches are deployed

bash

# Verify running kernel and sched_ext configuration
uname -r
grep CONFIG_SCHED_CLASS_EXT /boot/config-$(uname -r)

# List loaded BPF programs to identify sched_ext schedulers
bpftool prog list | grep -i sched

# Detach an active sched_ext scheduler (example)
systemctl stop scx_loader.service