UBUNTU-CVE-2026-99269: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: schedext: Wait for SCXOPSSDISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue() and hasn't cleared SCXOPSSDISPATCHING. The DSQ consume and move paths don't wait for the dispatch to finish and can operate on the task concurrently with the dispatcher. Call scxwaitdispatching() in scxmovelocaltasktolocaldsq(), unlinkdsqandswitchrqlock() and movetaskbetweendsqs() before they operate on the task. In scxmovelocaltasktolocaldsq(), wait before scxresolvelocaldsq() as it may update p->scx.flags.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Call scx_wait_dispatching() before operating on the task in scx_move_local_task_to_local_dsq(), unlink_dsq_and_switch_rq_lock(), and move_task_between_dsqs(); in scx_move_local_task_to_local_dsq(), call it before scx_resolve_local_dsq().
Event History
Frequently Asked Questions
Which Ubuntu systems are affected?
The affected software list includes Ubuntu kernel packages linux, linux-fips, linux-aws, linux-azure, linux-gcp, linux-oracle, linux-aws-fips, and linux-azure-fips.
What condition is required for the race to occur?
A task must be on a non-local dispatch queue while the CPU that dispatched it is still executing ops.dequeue() and has not cleared SCX_OPSS_DISPATCHING. A DSQ consume or move path can then operate on that task concurrently with the dispatcher.
What does the fix change?
The fix waits for dispatching to complete before moving or consuming tasks on DSQs in the affected paths. It also waits before scx_resolve_local_dsq() in scx_move_local_task_to_local_dsq(), because that function may update the task's sched_ext flags.