CVE-2026-98385
Received Received - Intake

sched_cache_group Use-After-Free in Linux Kernel

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sched/cache: Decouple sched_cache_group from mm to fix UAF Currently the sched cache grouping is by mm and the scheduling statistics sched_cache_stat lives in the mm structure. This ties the life cycle of scheduling stats with mm. In account_mm_sched(), the scheduling stats are accessed by task->mm->sc_stat. However, a task may be switching mm on one CPU when another CPU is running account_mm_sched(), and possibly accessing the old mm that was freed. This problem was found when running tests with KASAN by Hyunwoo: https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/ Instead of serializing the mm access by introducing extra acquisition of rq lock in the mm free path, extract sched_cache_stat from mm_struct, rename it as sched_cache_group and manage its life cycle apart from mm_struct with its own ref counting. This allows us in the next patch access sched_cache_group directly from task, and add a refcount on sched_cache_group when a task links to it. This prevents the use after free issue when accessing stale and released old mm and its sched cache stat a task switches to a new mm while account_mm_sched() is done elsewhere. The other benefit of this restructure is in the future, the grouping of tasks to a LLC would have the flexibility to be associated with a user defined grouping, or cgroup, cookie group, numa_group or others instead of just with a single mm address space. Rename sched_cache_stat to sched_cache_group and turn it into a refcounted object allocated from mm_struct. The mm_struct now holds a pointer (sched_cache_grp) to this object instead of embedding it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-98385
EUVD
EUVD-2026-97241

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux df0d98475954d655571979aa061ecb07d7e00392
Linux Linux df0d98475954d655571979aa061ecb07d7e00392
Linux Linux 7.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free (UAF) issue in the scheduling cache group. The problem occurs because scheduling statistics are tied to the memory management (mm) structure, which can be freed while another CPU is still accessing it. This happens when a task switches memory contexts (mm) on one CPU while another CPU is running scheduling accounting functions that reference the old mm structure.

Detection Guidance

This vulnerability is specific to the Linux kernel and involves a use-after-free issue in the scheduling cache group. Detection requires kernel-level inspection rather than network scanning. Check kernel logs for memory corruption errors or KASAN reports. Use commands like dmesg | grep -i kasan or journalctl -k | grep -i kasan to look for memory-related errors. If you suspect exploitation, monitor for crashes or unusual scheduling behavior.

Impact Analysis

This vulnerability could lead to system instability, crashes, or potential privilege escalation if exploited. It may cause memory corruption when the kernel tries to access freed memory, resulting in unpredictable behavior or denial of service.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's scheduling cache management. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory management. However, if exploited, it could lead to system instability or crashes, potentially affecting the availability of systems handling sensitive data.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves this issue. Check your distribution's security advisories for kernel updates. If updating is not immediately possible, consider isolating critical systems or limiting access to reduce exposure. Monitor for signs of exploitation such as crashes or memory corruption errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98385. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart