CVE-2026-98463: sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags

In the Linux kernel, the following vulnerability has been resolved:

schedext: Derive SCXRQINWAKEUP from the core enqueue flags

scheduledeferredlocked() skips scheduling a deferred action while SCXRQINWAKEUP is set and relies on the taskwokenscx() call that follows a wakeup enqueue to run it. enqueuetaskscx() sets the flag from the merged enqueue flags, which include the flags stashed for a remote activation. moveremotetasktolocaldsq() thus sets SCXRQINWAKEUP on the destination rq when the moved task was woken up, although no taskwokenscx() follows that activation.

An IMMED insert into a busy destination requests a local reenqueue during that enqueue. The request gets linked but not scheduled and stays pending until an unrelated wakeup or preemption on that CPU runs the deferred actions. The IMMED task sits behind the running task in the meantime. If nothing runs them before the scheduler is disabled, the request outlives the scheduler and points into its freed per-cpu area, which the next scheduler dereferences from rundeferred().

Test the core enqueue flags for the wakeup bit. Only the core's wakeup path is followed by taskwokenscx().