{
  "cveId": "CVE-2026-98865",
  "url": "https://patchblox.com/security/cve/CVE-2026-98865",
  "summary": "CVE-2026-98865 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98865 (version 7.2.10-1), released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  sched_ext: Don\u0027t run ops.dequeue() with a DSQ lo...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  sched_ext: Don\u0027t run ops.dequeue() with a DSQ lock held  ops.dequeue() is invoked with the source user DSQ\u0027s lock still held on the consume and move paths (scx_consume_dispatch_q(), move_task_between_dsqs()). A BPF scheduler which locks the source user DSQ from ops.dequeue() - e.g. by iterating it with bpf_iter_scx_dsq - self-deadlocks.  ops.dequeue() can only call the \u0022any\u0022 kfuncs and none of them can lock a builtin DSQ, so the global and bypass paths can\u0027t deadlock; however, all DSQ locks share one lockdep class, so iterating any user DSQ from ops.dequeue() on those paths trips the recursion check.  Move the invocation after the DSQ unlock on all three paths. SCX_TASK_IN_CUSTODY is cleared under the lock serializing the transfer so that the callback is invoked exactly once.",
  "published": "2026-10-18T16:17:40Z",
  "severity": "",
  "epss": 0.00169,
  "epssPercentile": 0.06237,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.10-1",
      "fix": "DEBIAN-CVE-2026-98865",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98865",
      "released": "2026-10-19T16:27:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}