Live › vulnerability › CVE-2026-98866
Go to dashboardA use-after-free in the Linux kernel scheduler's cache-group handling occurs when account_mm_sched() reaches a cache group through a task whose memory map is being switched. The fix gives each task its own reference to the cache group, so the group is not freed while still in use.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel built with CONFIG_SCHED_CACHE, where scheduler cache grouping is active. The sources do not say which kernel versions or distributions are affected, so the scope is unknown. Systems with the feature disabled are not affected by the code path described.
No product ranges from the sources yet.
uname -r to see the running kernel versiontask_struct->sched_cache_grp; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
sched/cache: Introduce task_struct->sched_cache_grp to fix UAF
Add a sched_cache_grp pointer to task_struct so that scheduler code can access the cache group directly via the task, without going through mm->sched_cache_grp. This decouples the scheduler's hot-path accesses from the mm_struct.
Each task holds its own refcount on the sched_cache_group, separate from the reference held by its mm_struct. The reference is acquired in copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm(). This fixes the use-after-free when account_mm_sched() reaches the group through a task whose mm is being switched, as reported by Hyunwoo:
https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/
Convert all scheduler code in fair.c and exit.c to use p->sched_cache_grp instead of p->mm->sched_cache_grp.
Keep the fork/exec/exit reference management out of the generic mm paths: add sched_cache_fork(), sched_cache_fork_cleanup(), sched_cache_exec_mmap() and sched_cache_exit_mm() in kernel/sched/cache_sched.c (with empty stubs for !CONFIG_SCHED_CACHE), so fs/exec.c, kernel/fork.c and kernel/exit.c each call one helper instead of open-coding the refcounting under #ifdef. Also add sched_cache_group_get() and task_cache_group_get().
This page as .md · .json · in your agent: get_signal("CVE-2026-98866")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.