Cloudanix VulnDB

CVE-2026-98220

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel scheduler can let specially crafted programs crash the entire system, requiring an update to prevent unexpected shutdowns.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in scx_vexit() triggered when COMPAT kfunc wrappers scx_bpf_select_cpu_and() or scx_bpf_dsq_insert_vtime() receive a task whose p->scx.sched is NULL (exited tasks or idle tasks) and pass it to scx_error() without RCU-protected read or ownership validation.

Why it matters to the business

Kernel crash on systems running sched_ext with sub-schedulers, causing denial of service, potential data loss, and unplanned downtime; low exploitability reduces immediate risk but still requires prompt patching on affected kernels.

How an attack unfolds

An attacker loads a BPF_PROG_TYPE_SYSCALL program that invokes the select_cpu kfunc wrapper on a zombie task (whose PID remains visible) while a sub-scheduler is attached; the missing RCU read and NULL check allows scx_task_sched() to return NULL, reaching scx_vexit() and dereferencing a NULL scheduler pointer.

How to fix it

Upgrade the Linux kernel to a version containing the sched_ext RCU-protected scheduler read fix; rebuild and reboot with the patched kernel; until then avoid attaching untrusted BPF programs that can reach the affected COMPAT wrappers.

How to confirm the fix worked

Confirm the kernel source contains the RCU read of p->scx.sched inside the COMPAT wrappers and that scx_error() is no longer called with a potentially NULL scheduler; test by running a BPF program exercising the wrappers against zombie and idle tasks.

Typical attack path

  1. Enable a sched_ext root scheduler with sub-schedulers attached
  2. Create or identify a zombie task whose sched pointer has been cleared
  3. Load and run a BPF_PROG_TYPE_SYSCALL program calling scx_bpf_select_cpu_and() on that task
  4. Trigger scx_error() with NULL scheduler, causing scx_vexit() to oops the kernel

How to detect it

Search kernel logs for BUG: kernel NULL pointer dereference at address 0000000000000398 combined with RIP in scx_vexit and call traces containing scx_bpf_select_cpu_and or bpf_prog_test_run_syscall; inspect audit logs for unexpected BPF program loads targeting syscall type programs while sched_ext sub-schedulers are active.

  • BUG: kernel NULL pointer dereference, address: 0000000000000398
  • RIP: scx_vexit+0x25
  • scx_bpf_select_cpu_and+0xab
  • sched_ext: BPF scheduler
  • Unassociated program run_select_cpu_

What your security team should do

  • Prioritize kernel upgrade on any system using sched_ext schedulers
  • Restrict unprivileged BPF program loading until patched
  • Monitor for kernel oops involving scx_vexit or scx_bpf_select_cpu_and
  • Review and deprecate use of the affected COMPAT kfunc wrappers

The record

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix NULL sched deref in kfunc sub-sched error paths When the root scheduler has sub-scheds attached, the COMPAT kfunc wrappers scx_bpf_select_cpu_and() and scx_bpf_dsq_insert_vtime() refuse the call and report to @p's scheduler: scx_error(scx_task_sched(p), "... must be used"); The wrappers are reachable with tasks that have no scheduler. scx_bpf_select_cpu_and() is in the select_cpu kfunc group, which scx_kfunc_context_filter() opens to BPF_PROG_TYPE_SYSCALL programs; scx_bpf_dsq_insert_vtime() is in the enqueue_dispatch group, which ops.enqueue() and ops.dispatch() may call with any KF_RCU task -- the group has no kf_tasks validation, and scx_dsq_insert_preamble() checks task ownership with scx_task_on_sched() precisely because @p may be an arbitrary task. scx_task_sched(p) is p->scx.sched, which is NULL for tasks past sched_ext_dead() -- which clears it via scx_disable_and_exit_task() on exit -- and for idle tasks, which the enable paths skip as they are never scheduled through SCX. It is also an rcu_dereference_protected() that expects @p's pi_lock or rq lock, which neither wrapper holds. Passing NULL to scx_error() reaches scx_vexit(), which dereferences sch->exit_info, oopsing the kernel. One concrete trigger exercised while developing the fix: a BPF_PROG_TYPE_SYSCALL program calling the select_cpu_and wrapper on an exited-but-not-reaped task while a sub-scheduler was attached (its pid stays findable while the zombie is unreaped; faulting instruction is the scx_vexit() prologue "mov r15,[rdi+0x398]" with RDI=NULL and 0x398 the offset of sch->exit_info): sched_ext: BPF scheduler "kfunc_subsched_null" enabled sched_ext: BPF sub-scheduler "kfunc_subsched_null" enabled sched_ext: Unassociated program run_select_cpu_ (id 76) BUG: kernel NULL pointer dereference, address: 0000000000000398 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 0 PID: 8201 Comm: kfunc_test_runn Tainted: G W RIP: 0010:scx_vexit+0x25/0xa0 Code: ... <4c> 8b bf 98 03 00 00 ... CR2: 0000000000000398 Call Trace: <TASK> __scx_exit+0x4f/0x70 scx_bpf_select_cpu_and+0xab/0xb0 bpf_prog_430ed61a7b66e03a_run_select_cpu_and+0x9c/0xe7 ? __x64_sys_bpf+0x2c/0x40 bpf_prog_test_run_syscall+0x130/0x2f0 __sys_bpf+0x930/0x10d0 ? __x64_sys_bpf+0x2c/0x40 __x64_sys_bpf+0x2c/0x40 do_syscall_64+0xbc/0x460 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Read @p's scheduler under RCU instead, which the wrappers can do from their guard(rcu)(): fault it when it can be determined, and when it can't be determined -- @p is a task past sched_ext_dead() or an idle task -- there is nothing obviously wrong to report, so just refuse the call as before without faulting any scheduler. These COMPAT wrappers are scheduled for eventual removal once the deprecation grace period elapses, but until then -- and regardless of their removal timeline -- they must not oops the kernel on a task they are handed.

Affected packages

Ecosystem Package Introduced Fixed