CVE-2026-99144

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99144", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.395Z", "datePublished": "2026-10-28T10:35:00.602Z", "dateUpdated": "2026-10-28T10:35:00.602Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-28T10:35:00.602Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue\n\nA deferred reenqueue can read a freed user DSQ. The request stays on its\nCPU's deferred list until run_deferred() takes it, and the RCU callback that\nfrees the DSQ assumes that the grace period has flushed it, so exit_dsq()\nchecks the per-CPU node without the deferred list lock. A grace period waits\nfor readers in flight, not for a pending run_deferred(). A run_deferred()\nwhich starts after the grace period began can detach the request right\nbefore the callback looks and then read the freed DSQ's id.\n\nCancel the pending requests before the grace period instead. The irq work\nthat frees the DSQ unlinks every CPU's request under the per-CPU deferred\nlist lock, and schedule_dsq_reenq() ignores a new request under the same\nlock once the id is invalid. Only a run_deferred() that started before the\ngrace period can hold a request, and it runs with IRQs disabled, so the\ngrace period waits for it and nothing touches the DSQ after the callback."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/ext/ext.c"], "versions": [{"version": "84b1a0ea0b7c23dec240783a592e480780efe459", "lessThan": "633f586329bfd9843bf8acf86c95353f4c16e22d", "status": "affected", "versionType": "git"}, {"version": "84b1a0ea0b7c23dec240783a592e480780efe459", "lessThan": "069403dff337feb192bfc70fb28ddc8a171e20c1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/ext/ext.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/633f586329bfd9843bf8acf86c95353f4c16e22d"}, {"url": "https://git.kernel.org/stable/c/069403dff337feb192bfc70fb28ddc8a171e20c1"}], "title": "sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/sched/ext/ext.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "633f586329bfd9843bf8acf86c95353f4c16e22d", "status": "affected", "version": "84b1a0ea0b7c23dec240783a592e480780efe459", "versionType": "git"}, {"lessThan": "069403dff337feb192bfc70fb28ddc8a171e20c1", "status": "affected", "version": "84b1a0ea0b7c23dec240783a592e480780efe459", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/sched/ext/ext.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue\n\nA deferred reenqueue can read a freed user DSQ. The request stays on its\nCPU's deferred list until run_deferred() takes it, and the RCU callback that\nfrees the DSQ assumes that the grace period has flushed it, so exit_dsq()\nchecks the per-CPU node without the deferred list lock. A grace period waits\nfor readers in flight, not for a pending run_deferred(). A run_deferred()\nwhich starts after the grace period began can detach the request right\nbefore the callback looks and then read the freed DSQ's id.\n\nCancel the pending requests before the grace period instead. The irq work\nthat frees the DSQ unlinks every CPU's request under the per-CPU deferred\nlist lock, and schedule_dsq_reenq() ignores a new request under the same\nlock once the id is invalid. Only a run_deferred() that started before the\ngrace period can hold a request, and it runs with IRQs disabled, so the\ngrace period waits for it and nothing touches the DSQ after the callback."}], "id": "CVE-2026-99144", "lastModified": "2026-10-28T11:17:34.433", "metrics": {}, "published": "2026-10-28T11:17:34.433", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/069403dff337feb192bfc70fb28ddc8a171e20c1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/633f586329bfd9843bf8acf86c95353f4c16e22d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of service via use-after-free in sched_ext", "id": "2562653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562653"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue\nA deferred reenqueue can read a freed user DSQ. The request stays on its\nCPU's deferred list until run_deferred() takes it, and the RCU callback that\nfrees the DSQ assumes that the grace period has flushed it, so exit_dsq()\nchecks the per-CPU node without the deferred list lock. A grace period waits\nfor readers in flight, not for a pending run_deferred(). A run_deferred()\nwhich starts after the grace period began can detach the request right\nbefore the callback looks and then read the freed DSQ's id.\nCancel the pending requests before the grace period instead. The irq work\nthat frees the DSQ unlinks every CPU's request under the per-CPU deferred\nlist lock, and schedule_dsq_reenq() ignores a new request under the same\nlock once the id is invalid. Only a run_deferred() that started before the\ngrace period can hold a request, and it runs with IRQs disabled, so the\ngrace period waits for it and nothing touches the DSQ after the callback.", "A flaw was found in the Linux kernel's sched_ext (extensible scheduler) component. A race condition during the destruction of a user dispatch queue allows a deferred task re-enqueue operation to access memory that has already been freed. A local user can exploit this use-after-free vulnerability to cause a system crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-99144", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T10:35:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99144\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99144\nhttps://git.kernel.org/stable/c/069403dff337feb192bfc70fb28ddc8a171e20c1\nhttps://git.kernel.org/stable/c/633f586329bfd9843bf8acf86c95353f4c16e22d"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[84b1a0ea0b7c23dec240783a592e480780efe459,633f586329bfd9843bf8acf86c95353f4c16e22d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[84b1a0ea0b7c23dec240783a592e480780efe459,069403dff337feb192bfc70fb28ddc8a171e20c1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[84b1a0ea0b7c23dec240783a592e480780efe459,633f586329bfd9843bf8acf86c95353f4c16e22d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[84b1a0ea0b7c23dec240783a592e480780efe459,069403dff337feb192bfc70fb28ddc8a171e20c1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:45:16.181518+00:00", "updated": "2026-10-30T02:15:05.351055+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-825"]}