A use‑after‑free flaw exists in the Linux kernel's scheduling subsystem (sched_ext). A delegated re‑enqueue can read a DSQ that has already been freed, allowing the attacker to read or target stale memory that the kernel has released. The bug arises from a race between the RCU callback that frees the DSQ and a run_deferred() that resumes after the grace period has begun, causing the callback to access a freed structure instance. This memory corruption can destabilize the kernel or provide a foothold for more advanced exploitation if the attacker can influence the contents of the freed memory.

The vulnerability affects all Linux kernel releases that contain the unpatched sched_ext implementation before the commit 069403dff337feb192bfc70fb28ddc8a171e20c1. Linux distributions shipping kernels from those versions are potentially impacted until the patch is applied.

The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog, indicating no known public exploitation. Nonetheless, the nature of the race condition and the privileged context of the kernel suggest a high impact for an attacker who can trigger the deferred re‑enqueue path, which may lead to a system crash or provide a vector for privilege escalation. The likely attack vector is inferred to involve crafted interactions that cause the kernel to schedule a DSQ for a deferred re‑enqueue and then trigger the RCU callback before the grace period completes, resulting in a use‑after‑free.