DEBIAN-CVE-2026-99104: Debian/linux vulnerability

Published Oct 28, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scxbypass() claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the depth returns to zero, but propagates only the depth to the descendants, not the claim. A descendant that starts bypassing with its ancestor never claims, and one whose own bypass ends under the ancestor's keeps its claim, as its depth does not return to zero. A sub-scheduler enable whose bypass ends under a PM suspend thus leaks its claim: the parent keeps hosting bypass dispatch and the sub-scheduler's next bypass trips the WARNONONCE() on the claim. A sub-scheduler disable that starts under a PM suspend has no claim, so once the resume lifts the root's bypass its tasks sit on the parent's bypass DSQs with nobody consuming them. Claim for every descendant whose depth goes from zero to one in the propagation and release every scheduler in the subtree whose depth returned to zero once the tasks have moved out of the bypass DSQs. A parent that is bypassing itself when a descendant claims consumes only its own bypass DSQs, empty until it leaves bypass and becomes the host.

Affected Software

1 affected component
debian/linux*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    Update scx_bypass() handling so every descendant scheduler whose bypass depth changes from zero to one claims bypass dispatch, and release every scheduler in the subtree whose depth returns to zero after tasks have moved out of the bypass DSQs.

Event History

Oct 28, 2026
CVE Published
via OSV·11:17 AM
Data Sourced
via OSV·11:17 AM
DescriptionAffected Software

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203