Cloudanix VulnDB

CVE-2026-98385

None

CVSS

—

EPSS

0.1%

Published

Oct 12, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in the Linux kernel's scheduling statistics could let one part of the system read memory that another part has already released, potentially crashing the machine.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free when account_mm_sched() dereferences task->mm->sc_stat after the mm_struct has been freed during a concurrent mm switch on another CPU.

Why it matters to the business

Kernel instability or crashes on Linux systems that can cause denial of service; low public exploit activity reduces immediate risk but still requires patching to maintain system reliability.

How an attack unfolds

An attacker triggers a race between a task switching its mm_struct and concurrent scheduler accounting on another CPU, allowing access to a freed mm and its embedded sched_cache_stat; the supplied fix decouples the object with separate refcounting to eliminate the window.

How to fix it

Apply the upstream kernel commit that extracts sched_cache_stat into a separately refcounted sched_cache_group object and updates task linkage to hold a reference; rebuild and deploy the fixed kernel across all affected Linux distributions.

How to confirm the fix worked

Confirm the running kernel contains the sched/cache decoupling change; re-run KASAN-enabled test suites that previously reproduced the UAF; verify no stale mm pointers remain in sched accounting paths.

Typical attack path

  1. Create or manipulate tasks that rapidly switch memory address spaces
  2. Induce scheduler accounting via CPU load or specific workloads on multiple CPUs
  3. Time the mm free path to coincide with account_mm_sched() access
  4. Trigger use-after-free for denial of service or attempt memory corruption

How to detect it

Inspect kernel logs and crash dumps for scheduler accounting faults involving mm_struct or sched_cache references; correlate with task exit or exec events that change address spaces on SMP systems.

What your security team should do

  • Prioritize kernel updates on multi-CPU production systems within standard patch windows given low EPSS and absence from KEV
  • Include scheduler and mm switch workloads in regression testing with memory safety tools
  • Monitor kernel logs for UAF-related oops after deployment
  • Track upstream stable branches for backports of the refcounting restructure

The record

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Decouple sched_cache_group from mm to fix UAF Currently the sched cache grouping is by mm and the scheduling statistics sched_cache_stat lives in the mm structure. This ties the life cycle of scheduling stats with mm. In account_mm_sched(), the scheduling stats are accessed by task->mm->sc_stat. However, a task may be switching mm on one CPU when another CPU is running account_mm_sched(), and possibly accessing the old mm that was freed. This problem was found when running tests with KASAN by Hyunwoo: https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/ Instead of serializing the mm access by introducing extra acquisition of rq lock in the mm free path, extract sched_cache_stat from mm_struct, rename it as sched_cache_group and manage its life cycle apart from mm_struct with its own ref counting. This allows us in the next patch access sched_cache_group directly from task, and add a refcount on sched_cache_group when a task links to it. This prevents the use after free issue when accessing stale and released old mm and its sched cache stat a task switches to a new mm while account_mm_sched() is done elsewhere. The other benefit of this restructure is in the future, the grouping of tasks to a LLC would have the flexibility to be associated with a user defined grouping, or cgroup, cookie group, numa_group or others instead of just with a single mm address space. Rename sched_cache_stat to sched_cache_group and turn it into a refcounted object allocated from mm_struct. The mm_struct now holds a pointer (sched_cache_grp) to this object instead of embedding it.

Affected packages

Ecosystem Package Introduced Fixed