CVE-2026-89518: Linux Kernel Race Condition Vulnerability

CVE-2026-89518 Overview

CVE-2026-89518 is a Linux kernel vulnerability in the sched_ext (SCX) subsystem. The flaw affects dispatch kernel functions (kfuncs) that incorrectly assumed this_rq() always matches the runqueue being dispatched. Under core scheduling, ops.dispatch() can execute on a CPU different from the dispatched runqueue's CPU. This mismatch triggers deadlock conditions and incorrect resolution of SCX_DSQ_LOCAL targets. The Linux kernel maintainers resolved the issue by using the runqueue tracked by scx_locked_rq() instead of this_rq().

Critical Impact
A dispatch operation targeting a sibling runqueue can acquire the source rq lock on top of an already-held dispatched rq lock, producing a kernel deadlock that halts scheduling on affected CPUs.

Affected Products

Linux kernel builds with sched_ext (SCX) support enabled
Systems using core scheduling with BPF schedulers
Distributions shipping kernels prior to fixes in commits 3dd52416 and 6d1890d3

Discovery Timeline

2026-09-11 - CVE-2026-89518 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89518

Vulnerability Analysis

The vulnerability resides in the extensible scheduler class (sched_ext) dispatch path. Under core scheduling, dispatch runs from within the core-wide pick and may target a sibling runqueue. Several kfunc paths assumed the executing CPU's runqueue and the dispatched runqueue always coincide. That assumption breaks when the dispatch operates on a sibling CPU's runqueue.

Three code paths were affected. scx_dsq_move() decided whether an rq lock was held by inspecting this_rq() flags. When dispatching for a sibling, it took the unlocked-context branch and attempted to acquire the source rq lock while the dispatched rq lock was already held, creating a deadlock. scx_bpf_sub_dispatch() dispatched this_rq() using its stashed sub_dispatch_prev, which is NULL when dispatching for a sibling. finish_dispatch(), scx_bpf_dsq_reenq(), and scx_bpf_dsq_nr_queued() resolved SCX_DSQ_LOCAL to the executing CPU's local dispatch queue rather than the dispatched runqueue's queue.

Root Cause

The kfuncs conflated the CPU executing the operation with the runqueue being operated on. this_rq() returns the current CPU's runqueue, which is incidental during core scheduling dispatch. The correct reference is the runqueue tracked by scx_locked_rq(), which is set to the dispatched rq around ops invocations and NULL in unlocked contexts.

Attack Vector

Exploitation requires local access to a system running a BPF scheduler with core scheduling enabled. The condition surfaces during normal scheduler operation when dispatch targets a sibling runqueue. A malicious or buggy sched_ext BPF program can reliably trigger the code paths, causing a kernel deadlock and denial of service. Remote exploitation is not applicable.

Refer to the Linux Kernel Commit 3dd52416 and Linux Kernel Commit 6d1890d3 for the source-level fixes and full context.

Detection Methods for CVE-2026-89518

Indicators of Compromise

Kernel soft-lockup or hard-lockup messages referencing sched_ext, scx_dsq_move, or finish_dispatch in dmesg or /var/log/kern.log.
Unexpected task stalls on systems with CONFIG_SCHED_CORE enabled and an active BPF scheduler attached through sched_ext.
Lockdep warnings reporting double-acquire of runqueue locks during dispatch operations.

Detection Strategies

Inventory hosts running kernels with sched_ext enabled and check for BPF schedulers loaded via bpftool prog show referencing struct_ops of type sched_ext_ops.
Compare running kernel versions against distribution advisories referencing commits 3dd52416 and 6d1890d3.
Monitor kernel crash and lockup telemetry from affected hosts, correlating with core scheduling and SCX activity.

Monitoring Recommendations

Ingest dmesg, kern.log, and kdump reports into your log analytics pipeline and alert on repeated sched_ext warnings.
Track kernel build versions across the fleet to identify hosts missing the upstream fix.
Track availability metrics on nodes that use custom BPF schedulers, as deadlocks manifest as scheduling stalls.

How to Mitigate CVE-2026-89518

Immediate Actions Required

Apply kernel updates that include commits 3dd52416e44a70bc993adb96d2e0d71b9ea21359 and 6d1890d3c6137ab523799765ae2de62cc05f116d.
Identify workloads relying on sched_ext BPF schedulers and validate they run on patched kernels before re-enabling core scheduling.
Reboot hosts after upgrading the kernel package to load the corrected sched_ext code paths.

Patch Information

The Linux kernel maintainers replaced this_rq() assumptions in the affected dispatch kfuncs with the rq tracked by scx_locked_rq(). This value is set to the dispatched rq around ops invocations and NULL in unlocked contexts, aligning the resolution with the insert side where SCX_DSQ_LOCAL dispatches land on the task's rq. See Linux Kernel Commit 3dd52416 and Linux Kernel Commit 6d1890d3.

Workarounds

Disable core scheduling (CONFIG_SCHED_CORE=n or unset sched_core at runtime) on hosts that cannot be patched immediately.
Detach custom sched_ext BPF schedulers and revert to the in-tree CFS/EEVDF scheduler until the fix is applied.
Restrict privileges required to load BPF struct_ops programs so that only trusted operators can attach schedulers.

bash

# Verify kernel version and check for sched_ext BPF schedulers
uname -r
bpftool struct_ops list | grep -i sched_ext

# Detach an active sched_ext scheduler as a temporary workaround
bpftool struct_ops unregister id <ID>