Linux Kernel Vulnerability in Scheduler Operations Leading to Self-Deadlocks

CVE-2026-98865

What is CVE-2026-98865?

A vulnerability in the Linux kernel allows for self-deadlocks during BPF scheduler operations due to the invocation of ops.dequeue() while holding a DSQ lock. This issue can lead to system instability when the dequeue operation is performed on a user DSQ lock, particularly affecting the consume and move task paths. Affected systems can experience delays or failures in task scheduling as a result. The vulnerability has been addressed by modifying the invocation of ops.dequeue() to occur post-DSQ lock release on affected paths, ensuring smoother task management.

References