UBUNTU-CVE-2026-99105: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: schedext: Fix stall when a task enqueued with SCXENQLAST lands back on its CPU's local DSQ With SCXOPSENQLAST, the last runnable task on a CPU is passed to ops.enqueue() instead of being kept running. Exiting tasks without SCXOPSENQEXITING, migration disabled tasks without SCXOPSENQMIGRATIONDISABLED and tasks on an offline rq skip ops.enqueue() and go straight to the local DSQ. This happens in putprevtaskscx() after the pick has settled on idle, so nothing reschedules the CPU, which idles with the task queued until an unrelated wakeup lands on it or the watchdog fires. scxmitosis, which sets SCXOPSENQLAST without SCXOPSENQEXITING, hit this during mass cgroup teardown: exiting tasks stuck in exitmmap() for over 40 seconds. A task put on the local DSQ runs, as anywhere else. If the SCXENQLAST enqueue left the task on this CPU's local DSQ, set needresched on the task being switched in, as proxyreschedidle() does. reschedcurr() would flag the task being put instead, and schedule() clears that right after the pick.
Affected Software
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
The issue is specific to Linux systems using sched_ext with SCX_OPS_ENQ_LAST enabled. The reported scenario involved scx_mitosis during mass cgroup teardown, where exiting tasks could remain stuck in exit_mmap().
What conditions lead to a task stall?
A stall can occur when the last runnable task is enqueued with SCX_ENQ_LAST, bypasses ops.enqueue(), and lands back on its CPU's local dispatch queue after scheduling has selected idle. This includes exiting tasks when SCX_OPS_ENQ_EXITING is not set, migration-disabled tasks when SCX_OPS_ENQ_MIGRATION_DISABLED is not set, and tasks on an offline runqueue.
What is the observable impact while the issue occurs?
The CPU can remain idle despite having a task queued on its local dispatch queue. The queued task may not run until an unrelated wakeup arrives on that CPU or the watchdog fires; the reported exiting tasks were stuck for more than 40 seconds.
Is a task permanently lost if it is placed on the local dispatch queue?
No. A task placed on the local dispatch queue will run, but this flaw can leave the CPU without a reschedule event to run it promptly.