CVE-2026-98865: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-98865 is a deadlock vulnerability in the Linux kernel's sched_ext (extensible scheduler) subsystem, where ops.dequeue() callbacks are invoked while a Dispatch Queue (DSQ) lock is still held. This allows a local user with BPF scheduler privileges to trigger a kernel deadlock or lockdep recursion detection, resulting in a denial of service. The vulnerability affects Linux kernel version 7.1 and is fixed in versions 7.2.10 and 7.3-rc5. It was published on October 18, 2026, with a CVSS category estimate of Medium (GitHub Advisory, Feedly).

The root cause is a locking order violation in the Linux kernel's sched_ext scheduler: ops.dequeue() is called before releasing the source user DSQ's lock in three code paths — scx_consume_dispatch_q(), move_task_between_dsqs(), and related functions. A BPF scheduler that attempts to lock or iterate over a user DSQ from within ops.dequeue() (e.g., via bpf_iter_scx_dsq) will self-deadlock on the consume and move paths, or trip lockdep's recursion check on other paths, because all DSQ locks share one lockdep class. The fix moves the ops.dequeue() invocation to after the DSQ unlock on all three paths, with SCX_TASK_IN_CUSTODY cleared under the lock to ensure the callback is invoked exactly once (GitHub Advisory, Kernel Patch 1, Kernel Patch 2).

A local attacker with the ability to load and run BPF scheduler programs can trigger a kernel deadlock or lockdep recursion detection, causing the scheduler to hang or crash and denying service to all other processes on the system. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise — but a kernel scheduler crash can render the entire system unresponsive, requiring a reboot (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date. The vulnerability requires local access and the ability to load BPF scheduler programs, which is typically restricted to privileged users. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

Apply the Linux kernel patch that moves ops.dequeue() invocations to occur after DSQ unlock on all three affected code paths; fixed versions are 7.2.10 (stable) and 7.3-rc5 (mainline), corresponding to commits fe499ae9da46e297f578d4346c4c8e338c3118db and cb86607ada73185f321baa7f9d94a08a3a40bbf5. As a workaround, restrict BPF scheduler program loading and execution to trusted, privileged users only, or disable sched_ext entirely if it is not required in your environment (GitHub Advisory, Kernel Patch 1, Kernel Patch 2).