The Linux kernel contains a race condition in the sched_ext (scheduler extension) path that allows a BPF program to trigger an error claim during a pre-enable window. This race leads to a use‑after‑free of the scheduler extension object, which can corrupt kernel memory, crash the system or provide a local attacker with the ability to elevate privileges. The flaw involves improper resource cleanup (CWE‑825).

Any Linux installation running a kernel that includes the vulnerable sched_ext code before the patches identified by commit hashes 959c66dc4a915be306c35691095c787c61dc7df9 and c7a1c6e8004ab12a9c9bfdcb603f60f9bf4a3cee is affected; no other vendors or products are listed as impacted.

The CVSS score of 5.5 and an EPSS score of less than 1% indicate a moderate severity with a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, implying no widespread exploitation has been reported. The likely attack vector is a local user who can load or trigger BPF programs that interact with the scheduler extension, creating the exploit race. If successfully exploited, the attacker could cause a denial of service or gain elevated privileges on the affected system.