Description
In the Linux kernel, the following vulnerability has been resolved:

sched/cache: Introduce task_struct->sched_cache_grp to fix UAF

Add a sched_cache_grp pointer to task_struct so that scheduler code
can access the cache group directly via the task, without going
through mm->sched_cache_grp. This decouples the scheduler's hot-path
accesses from the mm_struct.

Each task holds its own refcount on the sched_cache_group, separate
from the reference held by its mm_struct. The reference is acquired
in copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm().
This fixes the use-after-free when account_mm_sched() reaches the group
through a task whose mm is being switched, as reported by Hyunwoo:

https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/

Convert all scheduler code in fair.c and exit.c to use
p->sched_cache_grp instead of p->mm->sched_cache_grp.

Keep the fork/exec/exit reference management out of the generic mm
paths: add sched_cache_fork(), sched_cache_fork_cleanup(),
sched_cache_exec_mmap() and sched_cache_exit_mm() in
kernel/sched/cache_sched.c (with empty stubs for !CONFIG_SCHED_CACHE),
so fs/exec.c, kernel/fork.c and kernel/exit.c each call one helper
instead of open-coding the refcounting under #ifdef. Also add
sched_cache_group_get() and task_cache_group_get().
Published: 2026-10-18
Score: n/a
EPSS: n/a
KEV: No
Impact: Use-After-Free in the scheduler can lead to kernel memory corruption
Action: Apply Patch
AI Analysis

Impact

The bug involved a use‑after‑free when the scheduler accessed a task’s mm->sched_cache_grp after that task’s memory context had been switched. This flaw allowed memory to be freed while still in use, potentially corrupting critical kernel data structures and enabling privilege escalation. The fix adds a dedicated pointer in task_struct and strengthens reference counting so that scheduler code uses the new pointer and no longer depends on mm->sched_cache_grp during hot‑path execution.

Affected Systems

All Linux kernel versions that do not yet incorporate the patch adding task_struct->sched_cache_grp are affected. The commit that introduces the change has been merged into recent kernel releases, but the precise affected release range is not specified in the data provided.

Risk and Exploitability

This is a classic Use‑After‑Free (CWE-416) bug with potentially high impact if an attacker can trigger the race condition, as it involves kernel address space corruption. No CVSS or EPSS score is available, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is local or privilege escalation via manipulating task mm transitions; the exploit would require kernel context and might use a race to free the sched_cache_grp while still referenced by scheduler code.

Generated by OpenCVE AI on October 18, 2026 at 20:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a release that includes the task_struct->sched_cache_grp patch, or apply the corresponding patch directly to running kernel source and rebuild.
  • Reboot the system to load the patched kernel and ensure the hot‑path changes take effect.
  • Apply kernel hardening options such as address space layout randomization and strict memory protection policies, and enable monitoring for kernel faults that might indicate residual use‑after‑free attempts.

Generated by OpenCVE AI on October 18, 2026 at 20:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: sched/cache: Introduce task_struct->sched_cache_grp to fix UAF Add a sched_cache_grp pointer to task_struct so that scheduler code can access the cache group directly via the task, without going through mm->sched_cache_grp. This decouples the scheduler's hot-path accesses from the mm_struct. Each task holds its own refcount on the sched_cache_group, separate from the reference held by its mm_struct. The reference is acquired in copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm(). This fixes the use-after-free when account_mm_sched() reaches the group through a task whose mm is being switched, as reported by Hyunwoo: https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/ Convert all scheduler code in fair.c and exit.c to use p->sched_cache_grp instead of p->mm->sched_cache_grp. Keep the fork/exec/exit reference management out of the generic mm paths: add sched_cache_fork(), sched_cache_fork_cleanup(), sched_cache_exec_mmap() and sched_cache_exit_mm() in kernel/sched/cache_sched.c (with empty stubs for !CONFIG_SCHED_CACHE), so fs/exec.c, kernel/fork.c and kernel/exit.c each call one helper instead of open-coding the refcounting under #ifdef. Also add sched_cache_group_get() and task_cache_group_get().
Title sched/cache: Introduce task_struct->sched_cache_grp to fix UAF
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:51:27.883Z

Reserved: 2026-09-25T10:25:14.377Z

Link: CVE-2026-98866

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:41.117

Modified: 2026-10-18T16:17:41.117

Link: CVE-2026-98866

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T21:00:10Z

Weaknesses