Technical impact
The vulnerability originates when the scheduler extension caches a pointer to the scheduler configuration (scx_root) before it acquires the protecting lock scx_cgroup_ops_rwsem. If a scheduler is torn down via RCU work while another scheduler is enabled in the interim, the cached pointer becomes stale. A subsequent dereference of this freed object triggers a use‑after‑free, which can result in a kernel crash or, with sufficient privileges, arbitrary code execution at kernel level. The flaw is a classic double‑free/invalid‑memory‑use scenario identified by CWE‑416 and a race condition indicated by CWE‑825.
Affected Systems
Any Linux kernel that includes the sched_ext scheduler extension and exposes the cgroup setter functions (scx_group_set_weight, scx_group_set_idle, scx_group_set_bandwidth) is potentially affected. Version information is not supplied, implying the issue may exist in all kernels containing this code path, regardless of distribution or kernel release. No vendor‑specific packaging details are available.
Risk and Exploitability
The CVSS score of 7.0 classifies the flaw as high severity, yet the EPSS score of <1% suggests that real‑world exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploits. An attacker would need the ability to influence scheduler enable/disable operations, which typically requires privileged or kernel‑module execution rights. Consequently, while the theoretical risk to confidentiality, integrity, and availability is significant, the practical exploitation probability remains low without elevated privileges.
Ubuntu USN