CVE-2026-89516 Overview
CVE-2026-89516 is a Linux kernel vulnerability in the sched_ext scheduler extension subsystem. The flaw occurs in process_deferred_reenq_users(), which triggers a BUG_ON when a Dispatch Queue (DSQ) is destroyed before a deferred reenqueue operation runs. The scx_bpf_dsq_reenq() function queues a deferred reenqueue (dru) that executes from run_deferred() rather than ops.dispatch(). If destroy_dsq() invalidates the DSQ before the dru runs, the kernel observes dsq->id == SCX_DSQ_INVALID and hits the BUG_ON, causing a kernel panic.
Critical Impact
Local unprivileged conditions involving BPF scheduler operations can trigger a kernel BUG_ON and denial of service on systems running vulnerable sched_ext-enabled Linux kernels.
Affected Products
- Linux kernel builds with sched_ext (SCX) enabled
- Distributions shipping kernels prior to the fix commits 8d8dd8ae89ea and c480961a1e79
- Systems using BPF-based custom schedulers via scx_bpf_dsq_reenq()
Discovery Timeline
- 2026-09-11 - CVE-2026-89516 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89516
Vulnerability Analysis
The vulnerability resides in the extensible scheduler class (sched_ext), which allows BPF programs to implement custom task schedulers. Custom schedulers use Dispatch Queues (DSQs) to hold runnable tasks. The helper scx_bpf_dsq_reenq() schedules a deferred reenqueue operation (dru) that executes later from run_deferred(), decoupled from the dispatch path.
When a DSQ is destroyed by destroy_dsq() between the time a dru is queued and when it runs, the destroy path does not flush pending drus. The deferred handler process_deferred_reenq_users() then encounters a DSQ with id == SCX_DSQ_INVALID and executes a BUG_ON, halting the kernel. This is a kernel-level denial of service and a logic error in lifecycle management of scheduler queues.
Root Cause
The root cause is missing synchronization between DSQ destruction and pending deferred reenqueue work. destroy_dsq() invalidates the DSQ id without draining or canceling pending drus that reference it. Compounding this, the original code read dsq->id twice — once for the invalid check and once inside the BUG_ON — creating a race window where destroy_dsq() could invalidate the id between the two reads and still trigger the panic.
Attack Vector
Exploitation requires the ability to load or interact with a BPF sched_ext scheduler that invokes scx_bpf_dsq_reenq() and destroys DSQs. On systems where such privileges are delegated or where a custom scheduler exhibits this pattern, the resulting kernel panic denies service to the entire host. No remote network vector is present; the trigger is a race in kernel scheduler internals.
See the upstream commits for the resolved logic: Kernel Git Commit 8d8dd8a and Kernel Git Commit c480961a.
Detection Methods for CVE-2026-89516
Indicators of Compromise
- Kernel panic messages referencing process_deferred_reenq_users in the stack trace.
- BUG_ON assertions containing SCX_DSQ_INVALID references in dmesg or serial console output.
- Unexpected host reboots on systems running BPF sched_ext custom schedulers.
Detection Strategies
- Inventory kernels for CONFIG_SCHED_CLASS_EXT=y and identify hosts running third-party or custom SCX schedulers.
- Correlate kernel crash dumps with the affected code paths in kernel/sched/ext.c involving deferred reenqueue processing.
- Track loaded BPF programs and monitor use of scx_bpf_dsq_reenq() alongside DSQ create/destroy lifecycle events.
Monitoring Recommendations
- Forward kernel.crash and dmesg output to a centralized log platform for pattern-matching on BUG_ON assertions.
- Alert on repeated host reboots that follow BPF scheduler load events.
- Monitor bpf() syscall usage and BPF program load events to identify SCX scheduler activity across the fleet.
How to Mitigate CVE-2026-89516
Immediate Actions Required
- Apply the upstream stable kernel commits 8d8dd8ae89ea and c480961a1e79 and reboot affected hosts.
- Restrict CAP_BPF and CAP_SYS_ADMIN to trusted administrators to prevent unauthorized SCX scheduler loading.
- Audit any custom BPF schedulers for use of scx_bpf_dsq_reenq() combined with DSQ destruction patterns.
Patch Information
The fix skips destroyed DSQs in process_deferred_reenq_users() instead of triggering BUG_ON, and reads dsq->id once with READ_ONCE() to close the read-race window. Apply distribution kernel updates that include Kernel Git Commit 8d8dd8a and Kernel Git Commit c480961a.
Workarounds
- Disable sched_ext by unloading or not attaching custom SCX schedulers until the kernel is patched.
- Rebuild kernels without CONFIG_SCHED_CLASS_EXT where custom schedulers are not required.
- Limit BPF program loading through Linux Security Modules or sysctl kernel.unprivileged_bpf_disabled=1.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
