CVE-2026-98864

In the Linux kernel, the following vulnerability has been resolved:

sched ext: Wait for SCX OPSS DISPATCHING before reenqueueing a task

ebf1ccff79c4 ("sched ext: Fix ops.dequeue() semantics") moved the final ops state store in scx dispatch enqueue() after the DSQ unlock so that the custody update and ops.dequeue() precede it. A task can thus be found on a DSQ while still SCX OPSS DISPATCHING.

The dequeue and core-sched pick paths wait for the state to clear in ops dequeue() but the reenqueue paths don't. A reenqueue in that window runs ops.enqueue() and sets SCX OPSS QUEUED before the dispatch has completed. The dispatcher's final store then overwrites it with SCX OPSS NONE and finish dispatch() drops every later dispatch of the task.

Wait for SCX OPSS DISPATCHING to clear before dequeueing a task for reenqueue, the same way ops dequeue() does.