CVE-2026-98866
Received Received - Intake

Use-After-Free in Linux Kernel Scheduler

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sched/cache: Introduce task_struct->sched_cache_grp to fix UAF Add a sched_cache_grp pointer to task_struct so that scheduler code can access the cache group directly via the task, without going through mm->sched_cache_grp. This decouples the scheduler's hot-path accesses from the mm_struct. Each task holds its own refcount on the sched_cache_group, separate from the reference held by its mm_struct. The reference is acquired in copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm(). This fixes the use-after-free when account_mm_sched() reaches the group through a task whose mm is being switched, as reported by Hyunwoo: https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/ Convert all scheduler code in fair.c and exit.c to use p->sched_cache_grp instead of p->mm->sched_cache_grp. Keep the fork/exec/exit reference management out of the generic mm paths: add sched_cache_fork(), sched_cache_fork_cleanup(), sched_cache_exec_mmap() and sched_cache_exit_mm() in kernel/sched/cache_sched.c (with empty stubs for !CONFIG_SCHED_CACHE), so fs/exec.c, kernel/fork.c and kernel/exit.c each call one helper instead of open-coding the refcounting under #ifdef. Also add sched_cache_group_get() and task_cache_group_get().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98866
EUVD
EUVD-2026-103806

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux df0d98475954d655571979aa061ecb07d7e00392
Linux Linux df0d98475954d655571979aa061ecb07d7e00392
Linux Linux 7.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free (UAF) issue in the scheduler's cache group handling. The fix introduces a sched_cache_grp pointer in task_struct to allow direct access to cache groups without relying on mm_struct. This prevents UAF when the scheduler accesses a group through a task whose memory management structure (mm) is being switched.

Detection Guidance

This vulnerability is specific to the Linux kernel's scheduler cache handling. Detection requires checking kernel version and scheduler code for the described use-after-free (UAF) issue in sched_cache_grp handling. No direct network detection commands exist; inspect kernel source or logs for scheduler-related crashes or memory corruption.

Impact Analysis

This vulnerability could lead to system instability or crashes if exploited. It may allow attackers to execute arbitrary code or escalate privileges by triggering a use-after-free condition in the Linux kernel's scheduler.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the UAF issue in sched_cache_grp. Monitor kernel logs for scheduler-related errors or crashes. If affected, reboot into a patched kernel version immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98866. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart