The Linux kernel scheduler extension publishes the CID tables before fully constructing them, causing a race between enabling and final publishing. A tracing or system-call program can read these incomplete tables and discover uninitialized kernel memory, leading to information leakage. This represents an information-exposure flaw tied to CWE-820. The vulnerability arises from inadequate RCU synchronization and lack of null checks in certain helper functions, scx_bpf_this_cid() and scx_bpf_task_cid(), which further expose kernel data.

All upstream Linux kernel releases that have not yet incorporated the patch for CVE‑2026‑98942 are, as the flaw resides in the sched_ext and cid helper components of the scheduler. The issue is present in both CPU-form and CID-form scheduler roots, and any kernel built before the fix could allow a local or privileged attacker to trigger the race condition by enabling or disabling the scheduler.

The CVSS score of 4.7 indicates a moderate severity, while the EPSS score of <1% suggests a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is exploitation by a local user or process that can trigger tracing or bpf helpers to read the CID tables during a scheduler transition, potentially leaking confidential kernel memory. The flaw does not enable direct code execution or privilege escalation.