The vulnerability occurs in the scheduler extension function scx_root_enable_workfn. A put_task_struct call precedes an scx_error dereference of the task’s comm and pid fields. When the iterator’s reference count drops to zero, the task structure can be freed synchronously, causing a use‑after‑free. This dangling pointer can corrupt kernel memory. Based on the description, it is inferred that an attacker with local access could exploit the memory corruption to crash the kernel or potentially execute arbitrary code in privileged mode.

All Linux kernel releases that ship the sched_ext scheduler extension without the upstream fix are potentially vulnerable. The advisory does not specify version constraints, so any system running an unpatched kernel branch that includes sched_ext remains at risk.

The CVSS score is 7.8, and the EPSS score is reported as < 1 %, indicating a very low probability of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. The flaw resides in kernel space and requires the attacker to trigger a specific iterator state; therefore, the attack vector is inferred to be local. The risk is described as moderate because local privilege escalation could compromise kernel integrity and confidentiality, but the low exploitation likelihood lowers the urgency.