CVE-2026-98463

In the Linux kernel, the following vulnerability has been resolved:

sched ext: Derive SCX RQ IN WAKEUP from the core enqueue flags

schedule deferred locked() skips scheduling a deferred action while SCX RQ IN WAKEUP is set and relies on the task woken scx() call that follows a wakeup enqueue to run it. enqueue task scx() sets the flag from the merged enqueue flags, which include the flags stashed for a remote activation. move remote task to local dsq() thus sets SCX RQ IN WAKEUP on the destination rq when the moved task was woken up, although no task woken scx() follows that activation.

An IMMED insert into a busy destination requests a local reenqueue during that enqueue. The request gets linked but not scheduled and stays pending until an unrelated wakeup or preemption on that CPU runs the deferred actions. The IMMED task sits behind the running task in the meantime. If nothing runs them before the scheduler is disabled, the request outlives the scheduler and points into its freed per-cpu area, which the next scheduler dereferences from run deferred().

Test the core enqueue flags for the wakeup bit. Only the core's wakeup path is followed by task woken scx().