The vulnerability occurs when the scheduler extension caches the scx_root pointer before acquiring the scx_cgroup_ops_rwsem lock. If the scheduler is disabled and freed by RCU work, and a new scheduler is enabled before the lock is acquired, the stale pointer can be dereferenced, leading to a use‑after‑free. An attacker with sufficient privileges could trigger this scenario to crash the kernel or potentially execute arbitrary code at kernel privilege level.

All Linux installations that include the sched_ext scheduler extension and use scx_root in cgroup setter functions are potentially affected. No specific kernel version is listed, indicating the flaw applies to any kernel containing this code path.

The CVSS score is not published and EPSS is not available, but a use‑after‑free in kernel space represents a high‑severity flaw. The attack vector would require an attacker to influence scheduler enable/disable operations, typically through privileged code or kernel modules. The vulnerability is listed as not in CISA KEV, yet the potential impact warrants immediate attention.