CVE-2026-68094

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sched_ext: Preserve rq tracking across local DSQ dispatch<br /> <br /> dispatch_to_local_dsq() can run from scx_bpf_dsq_move_to_local() while<br /> ops.dispatch() has recorded the current rq. Moving a task to a local DSQ<br /> may switch to the source or destination rq before synchronously invoking<br /> ops.dequeue() through the following path:<br /> <br /> SCX_CALL_OP(dispatch, rq)<br /> ops.dispatch()<br /> scx_bpf_dsq_move_to_local()<br /> scx_flush_dispatch_buf()<br /> finish_dispatch()<br /> dispatch_to_local_dsq()<br /> scx_dispatch_enqueue()<br /> local_dsq_post_enq()<br /> call_task_dequeue()<br /> SCX_CALL_OP_TASK(dequeue, locked_rq, ...)<br /> <br /> The nested callback saves the recorded rq and restores it on return. If<br /> the rq tracking does not follow the lock switch, update_locked_rq() can<br /> trigger the following lockdep assertion while restoring an rq which is<br /> no longer held:<br /> <br /> WARNING: kernel/sched/sched.h:1641 at call_task_dequeue+0x160/0x170<br /> Call Trace:<br /> scx_dispatch_enqueue+0x2b0/0x460<br /> dispatch_to_local_dsq+0x138/0x230<br /> scx_flush_dispatch_buf+0x1af/0x220<br /> scx_bpf_dsq_move_to_local___v2+0xe2/0x1c0<br /> bpf__sched_ext_ops_dispatch+0x4b/0xa7<br /> do_pick_task_scx+0x3b6/0x910<br /> __pick_next_task+0x105/0x1f0<br /> __schedule+0x3e7/0x1980<br /> <br /> Introduce switch_rq_lock() to update the tracking state together with<br /> each rq lock handoff. Use it in dispatch_to_local_dsq(),<br /> move_remote_task_to_local_dsq() and the in-balance paths of<br /> scx_dsq_move(), ensuring that scx_locked_rq() consistently refers to the<br /> rq whose lock is actually held throughout the lock dance.