{"id":33288,"date":"2026-10-06T20:31:41","date_gmt":"2026-10-06T12:31:41","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98219"},"modified":"2026-10-06T20:31:41","modified_gmt":"2026-10-06T12:31:41","slug":"cve-2026-98219","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98219","title":{"rendered":"CVE-2026-98219 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Close the"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>sched_ext: Close the pre-enable ops error claim window<\/p>\n<p>scx_alloc_and_add_sched() publishes ops-&gt;priv before<br \/>\nscx_root_enable_workfn() switches the state to SCX_ENABLING. An error<br \/>\nclaimed via scx_bpf_error_bstr() from an associated BPF program in that<br \/>\nwindow is consumed by scx_disable_workfn(), which takes the pre-enable<br \/>\nshortcut in scx_root_disable(). The shortcut returns without any teardown<br \/>\nand restores SCX_DISABLED with an unconditional scx_set_enable_state() xchg<br \/>\nracing the enable workfn&#8217;s own transition. The enable then completes with<br \/>\nthe claim consumed: the scheduler stays up but can never be disabled again,<br \/>\nand bpf_scx_unreg() frees it while still in use, resulting in a<br \/>\nuse-after-free. Both WARN_ON_ONCE()s fire back to back:<\/p>\n<p>  WARNING: kernel\/sched\/ext\/ext.c:7522 at<br \/>\n  scx_root_enable_workfn+0xeec\/0x1be0, CPU#3: scx_enable_help\/276<\/p>\n<p>  WARNING: kernel\/sched\/ext\/ext.c:6398 at scx_root_disable+0xb50\/0xdb8,<br \/>\n  CPU#0: sched_ext_helpe\/664<\/p>\n<p>scx_root_enable_workfn() switches to SCX_ENABLING before the scheduler<br \/>\nallocation, so ops-&gt;priv is never visible while SCX_DISABLED. The allocation<br \/>\nfailure path restores SCX_DISABLED.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>sched_ext: Close the pre-enable ops error claim window<\/p>\n<p>scx_alloc_and_add_sched() publishes ops-&gt;priv before<br \/>\nscx_root_enable_workfn<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33288","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}