Linux Kernel Task Scheduling Race Condition in sched_ext

CVE-2026-99269 is a race condition vulnerability in the Linux kernel's extended scheduler (sched_ext) that allows concurrent access to task dispatch queues (DSQs) while dispatch operations are still in progress. This vulnerability affects systems running vulnerable Linux kernel versions that implement the sched_ext scheduler, particularly those using custom scheduling classes. The issue arises when tasks are moved off non-local DSQs without waiting for the SCX_OPSS_DISPATCHING flag to clear, creating a window where the dispatcher and DSQ consumer can operate on the same task simultaneously. This can lead to data corruption, task state inconsistencies, or denial of service conditions in kernel scheduling logic.

While CVE-2026-99269 does not map directly to existing MITRE ATT&CK techniques or currently matched Casky skills, the vulnerability pattern aligns with kernel-level race conditions that could support privilege escalation or denial of service attacks. Practitioners using Casky's AI-driven analysis would identify similar vulnerabilities through techniques like T1548.004 (Abuse Elevation Control Mechanism) and T1499 (Endpoint Denial of Service) by examining kernel logs, process scheduling anomalies, and system stability metrics. Extended reasoning over Casky's 754 security skills would flag concurrent access patterns in kernel code, improper synchronization primitives, and dispatch operation state management—enabling defenders to detect exploitation attempts through behavioral monitoring of task scheduling anomalies and CPU dispatch inconsistencies.