CVE-2026-98385

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched/cache: Decouple sched_cache_group from mm to fix UAF

Currently the sched cache grouping is by mm and the scheduling statistics

sched_cache_stat lives in the mm structure. This ties the life cycle

of scheduling stats with mm.

In account_mm_sched(), the scheduling stats are accessed by

task->mm->sc_stat. However, a task may be switching mm on one CPU when

another CPU is running account_mm_sched(), and possibly accessing the

old mm that was freed. This problem was found when running tests with

KASAN by Hyunwoo:

https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/

Instead of serializing the mm access by introducing extra acquisition of

rq lock in the mm free path, extract sched_cache_stat from mm_struct,

rename it as sched_cache_group and manage its life cycle apart from

mm_struct with its own ref counting. This allows us in the next patch

access sched_cache_group directly from task, and add a refcount

on

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References