CVE-2026-64226

Awaiting Analysis Awaiting Analysis - Queue

sched_ext UAF in Linux Kernel

Publication date: 2026-07-24

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error() dereferences p->comm and p->pid. If the iterator's reference is the last drop, the task is freed synchronously and the deref becomes a UAF. Move put_task_struct() past scx_error().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-08-13

Generated

2026-08-13

AI Q&A

2026-07-24

EPSS Evaluated

2026-08-12

NVD

CVE-2026-64226

EUVD

EUVD-2026-48634

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.12 (inc) to 6.12.92 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's sched_ext subsystem. It occurs in the scx_root_enable_workfn() function where a task structure pointer is freed before another part of the code tries to access it. Specifically, put_task_struct(p) is called too early, potentially freeing the task while scx_error() still needs to read p->comm and p->pid, leading to a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's sched_ext subsystem and requires kernel-level detection. No direct network or system commands are provided in the context to detect this issue. Monitoring kernel logs for crashes or unusual task management events may help identify related issues.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. If exploited, it may lead to system instability, data corruption, or unauthorized access depending on the attacker's goals and system configuration.

Compliance Impact

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's sched_ext subsystem. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory management flaws.

Mitigation Strategies

Apply the latest Linux kernel patches or updates that address this vulnerability. If using a custom or patched kernel, ensure the fix for CVE-2026-64226 is included. Restart systems after applying updates to ensure the patched kernel is active.

Hi! I’m here to help you understand CVE-2026-64226. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70