CVE-2026-89516: sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users
In the Linux kernel, the following vulnerability has been resolved:
schedext: Don't BUGON a destroyed DSQ in processdeferredreenqusers
scxbpfdsqreenq() queues a deferred reenq (dru) that runs from rundeferred(), not ops.dispatch(). If the DSQ is destroyed before the dru runs, processdeferredreenqusers() sees dsq->id == SCXDSQINVALID and hits the BUGON. destroydsq() doesn't flush pending drus, so just skip.
tj: Read dsq->id once with READONCE(). Reading it separately in the INVALID check and the BUGON would leave a window where destroydsq() can invalidate the id between the two reads and still trigger the BUGON.
Event History
Frequently Asked Questions
What conditions are required to trigger the failure?
A deferred reenqueue must be queued through scx_bpf_dsq_reenq(), and the associated DSQ must be destroyed before that deferred work runs from run_deferred(). This causes the DSQ ID to become invalid while pending deferred reenqueue users are processed.
What is the observable impact if the issue is triggered?
The kernel reaches a BUG_ON in process_deferred_reenq_users() when it encounters the destroyed DSQ. The provided data identifies this as a kernel BUG condition.
What does the fix change?
The fix skips deferred reenqueue work for a DSQ whose ID is invalid rather than asserting. It also reads the DSQ ID once with READ_ONCE() to avoid a race where destruction invalidates the ID between separate checks.