---
id: "CVE-2026-98866"
kind: "vulnerability"
aliases: ["CVE-2026-98866"]
title: "Linux kernel: scheduler cache group reference race causes use-after-free"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["kubernetes", "linux-kernel", "runtime", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-18T16:17:41+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:12:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98866", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Linux kernel: scheduler cache group reference race causes use-after-free

A use-after-free in the Linux kernel scheduler's cache-group handling occurs when account_mm_sched() reaches a cache group through a task whose memory map is being switched. The fix gives each task its own reference to the cache group, so the group is not freed while still in use.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` to see the running kernel version
- unknown whether the sources list affected kernel versions

## Fix

- Update the Linux kernel to a release that includes the upstream commit adding `task_struct->sched_cache_grp`; the exact fixed version is unknown from the sources
- Check your distribution's kernel advisories for the fixed package version

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98866

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

sched/cache: Introduce task_struct->sched_cache_grp to fix UAF

Add a sched_cache_grp pointer to task_struct so that scheduler code
can access the cache group directly via the task, without going
through mm->sched_cache_grp.  This decouples the scheduler's hot-path
accesses from the mm_struct.

Each task holds its own refcount on the sched_cache_group, separate
from the reference held by its mm_struct.  The reference is acquired
in copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm().
This fixes the use-after-free when account_mm_sched() reaches the group
through a task whose mm is being switched, as reported by Hyunwoo:

  https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/

Convert all scheduler code in fair.c and exit.c to use
p->sched_cache_grp instead of p->mm->sched_cache_grp.

Keep the fork/exec/exit reference management out of the generic mm
paths: add sched_cache_fork(), sched_cache_fork_cleanup(),
sched_cache_exec_mmap() and sched_cache_exit_mm() in
kernel/sched/cache_sched.c (with empty stubs for !CONFIG_SCHED_CACHE),
so fs/exec.c, kernel/fork.c and kernel/exit.c each call one helper
instead of open-coding the refcounting under #ifdef.  Also add
sched_cache_group_get() and task_cache_group_get().

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_