{"id":"CVE-2026-98866","kind":"vulnerability","aliases":["CVE-2026-98866"],"related":[],"title":"Linux kernel: scheduler cache group reference race causes use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched/cache: Introduce task_struct->sched_cache_grp to fix UAF\n\nAdd a sched_cache_grp pointer to task_struct so that scheduler code\ncan access the cache group directly via the task, without going\nthrough mm->sched_cache_grp.  This decouples the scheduler's hot-path\naccesses from the mm_struct.\n\nEach task holds its own refcount on the sched_cache_group, separate\nfrom the reference held by its mm_struct.  The reference is acquired\nin copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm().\nThis fixes the use-after-free when account_mm_sched() reaches the group\nthrough a task whose mm is being switched, as reported by Hyunwoo:\n\n  https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/\n\nConvert all scheduler code in fair.c and exit.c to use\np->sched_cache_grp instead of p->mm->sched_cache_grp.\n\nKeep the fork/exec/exit reference management out of the generic mm\npaths: add sched_cache_fork(), sched_cache_fork_cleanup(),\nsched_cache_exec_mmap() and sched_cache_exit_mm() in\nkernel/sched/cache_sched.c (with empty stubs for !CONFIG_SCHED_CACHE),\nso fs/exec.c, kernel/fork.c and kernel/exit.c each call one helper\ninstead of open-coding the refcounting under #ifdef.  Also add\nsched_cache_group_get() and task_cache_group_get().","summary":"A use-after-free in the Linux kernel scheduler's cache-group handling occurs when account_mm_sched() reaches a cache group through a task whose memory map is being switched. The fix gives each task its own reference to the cache group, so the group is not freed while still in use.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kubernetes","linux-kernel","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- `uname -r` to see the running kernel version\n- unknown whether the sources list affected kernel versions","fix":"- Update the Linux kernel to a release that includes the upstream commit adding `task_struct->sched_cache_grp`; the exact fixed version is unknown from the sources\n- Check your distribution's kernel advisories for the fixed package version","status":"open","published_at":"2026-10-18T16:17:41+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:48+00:00","updated_at":"2026-10-25T05:12:48+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:12:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit adding `task_struct->sched_cache_grp`; the exact fixed version is unknown from the sources\n- Check your distribution's kernel advisories for the fixed package version","reach":"local","title":"Linux kernel: scheduler cache group reference race causes use-after-free","impact":"high","summary":"A use-after-free in the Linux kernel scheduler's cache-group handling occurs when account_mm_sched() reaches a cache group through a task whose memory map is being switched. The fix gives each task its own reference to the cache group, so the group is not freed while still in use.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted","kubernetes"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; a use-after-free in kernel memory may allow crashes or privilege escalation","analyst_note":"Find affected kernel version ranges and the fixed stable release from the NVD entry and the linked kernel.org stable commits.","how_to_check":"- `uname -r` to see the running kernel version\n- unknown whether the sources list affected kernel versions","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running a Linux kernel built with CONFIG_SCHED_CACHE, where scheduler cache grouping is active. The sources do not say which kernel versions or distributions are affected, so the scope is unknown. Systems with the feature disabled are not affected by the code path described.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000659,"input_tokens":3755,"output_tokens":566,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98866':15A,18A '/lkml/appb-dr4npyuhqok@v4bel/':209C 'access':116C,139C 'account':44B,189C 'acquir':167C 'add':102C,242C,287C 'also':286C 'cach':4A,39B,49B,70B,97C,105C,118C,129C,153C,222C,229C,244C,247C,251C,256C,267C,289C,294C 'cache-group':38B 'call':274C 'caus':8A 'cleanup':249C 'code':114C,213C,281C 'config':265C 'convert':210C 'copi':169C 'cve':13A,16A 'decoupl':132C 'direct':120C 'empti':262C 'exec':173C,175C,252C 'exit':179C,257C 'exit.c':217C 'fair.c':215C 'fix':61B,100C,182C 'follow':87C 'fork':171C,245C,248C 'fork/exec/exit':233C 'free':12A,31B,187C 'freed':77B 'fs/exec.c':269C 'generic':239C 'get':291C,296C 'give':62B 'go':125C 'group':5A,40B,50B,71B,74B,119C,154C,194C,290C,295C 'grp':98C,106C,130C,223C,230C 'handl':41B 'held':159C 'helper':276C 'hold':146C 'host':26B 'hot':137C 'hot-path':136C 'hyunwoo':206C 'ifdef':285C 'instead':224C,277C 'introduc':93C 'keep':231C 'kernel':2A,22B,35B,85C 'kernel/exit.c':272C 'kernel/fork.c':270C 'kernel/sched/cache_sched.c':260C 'kubernet':19B 'linux':1A,21B,34B,84C 'linux-kernel':20B 'lore.kernel.org':208C 'lore.kernel.org/lkml/appb-dr4npyuhqok@v4bel/':207C 'manag':235C 'map':56B 'memori':55B 'mm':45B,127C,142C,162C,170C,180C,190C,199C,227C,240C,258C 'mmap':174C,253C 'occur':42B 'one':275C 'open':280C 'open-cod':279C 'p':220C,226C 'path':138C,241C 'pointer':107C 'race':7A 'reach':47B,192C 'refcount':149C,283C 'refer':6A,67B,158C,165C,234C 'releas':177C 'report':204C 'resolv':91C 'runtim':23B 'sched':46B,96C,104C,128C,152C,191C,221C,228C,243C,246C,250C,255C,266C,288C 'sched/cache':92C 'schedul':3A,36B,113C,134C,212C 'self':25B 'self-host':24B 'separ':155C 'still':79B 'struct':95C,110C,143C,163C 'stub':263C 'switch':59B,202C 'task':53B,64B,94C,109C,123C,145C,197C,293C 'uaf':101C 'use':10A,29B,81B,185C,219C 'use-after-fre':9A,28B,184C 'via':121C 'vulner':88C 'whose':54B,198C 'without':124C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel built with CONFIG_SCHED_CACHE, where scheduler cache grouping is active. The sources do not say which kernel versions or distributions are affected, so the scope is unknown. Systems with the feature disabled are not affected by the code path described.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98866","severity":null,"published_at":"2026-10-18T16:17:41+00:00","modified_at":"2026-10-19T10:19:50+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}