CVE-2026-98866

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched/cache: Introduce task_struct->sched_cache_grp to fix UAF

Add a sched_cache_grp pointer to task_struct so that scheduler code

can access the cache group directly via the task, without going

through mm->sched_cache_grp. This decouples the scheduler's hot-path

accesses from the mm_struct.

Each task holds its own refcount on the sched_cache_group, separate

from the reference held by its mm_struct. The reference is acquired

in copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm().

This fixes the use-after-free when account_mm_sched() reaches the group

through a task whose mm is being switched, as reported by Hyunwoo:

https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/

Convert all scheduler code in fair.c and exit.c to use

p->sched_cache_grp instead of p->mm->sched_cache_grp.

Keep the fork/exec/exit reference management out of the generic mm

paths: add sched_cache_fork(), sched_cache_fork_cleanu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References