What is the CVSS score of CVE-2026-74731?

CVE-2026-74731 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74731?

CVE-2026-74731 is a Linux kernel use-after-free in the sched_ext scheduler allowing local users to achieve complete system compromise; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-74731?

Within 24 hours, consult vendor security advisory to identify affected Linux kernel versions and audit infrastructure to inventory vulnerable systems, prioritizing by business criticality and scope of local user access. Within 7 days, apply vendor-provided kernel patches to critical and production systems and validate installation and stability. Within 30 days, complete patching of remaining affected systems and perform post-patch verification through kernel version audits.

Linux Kernel CVE-2026-74731

EUVD-2026-64418 HIGH

2026-08-22 Linux

GHSA-39hf-rf3c-rjqv

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition timing requirement elevates AC to H; PR:L reflects required low-privilege local access; high C/I/A retained given kernel use-after-free impact potential.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 25, 2026 - 07:37 vuln.today

CVSS changed

Aug 25, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 22, 2026 - 16:01 EUVD

CVE Published

Aug 22, 2026 - 15:33 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 22, 2026 - 15:33 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Skip sub-disable teardown for never-linked sub-schedulers

A sub-scheduler enable can fail before scx_link_sched() links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs the full scx_sub_disable().

That is racy against root disable: drain_descendants() is the only ordering between a sub's disable-time task walk and root disable's all-task teardown, and an unlinked sub is invisible to it. Root's teardown can thus run between the never-linked sub's drain and its walk, exiting every task to no scheduler.

The walk then trips the membership WARN and re-homes the exited tasks onto the dying hierarchy, a use-after-free.

Skip the cgroup ownership reset and the task walk if @sch was never linked, indicated by the empty ->sibling as unlinking only happens later in the same function. The membership WARN remains valid: a linked sub is always waited on by an ancestor's drain.

AnalysisAI

Use-after-free in the Linux kernel's sched_ext (extensible BPF scheduler) subsystem allows a local low-privileged attacker to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability compromise of the affected system. The race condition arises when a sub-scheduler enable fails before being linked into the scheduler hierarchy, yet the full teardown path still executes concurrently against root scheduler disable, causing tasks to be re-homed onto an already-freed scheduler hierarchy. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain low-privilege local shell access

Delivery

Load or observe active sched_ext sub-scheduler

Exploit

Trigger sub-scheduler enable to fail pre-link

Install

Race concurrent root scheduler disable

Bypass drain_descendants ordering via unlinked sub invisibility

Execute

Trigger task re-homing to freed scheduler hierarchy

Impact

Achieve kernel use-after-free for privilege escalation

Recon

Obtain low-privilege local shell access

Delivery

Load or observe active sched_ext sub-scheduler

Exploit

Trigger sub-scheduler enable to fail pre-link

Install

Race concurrent root scheduler disable

Bypass drain_descendants ordering via unlinked sub invisibility

Execute

Trigger task re-homing to freed scheduler hierarchy

Impact

Achieve kernel use-after-free for privilege escalation

Vulnerability AssessmentAI

Exploitation	Exploitation requires local system access with low-privilege credentials (PR:L per vendor CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local-only attack vector and high impact triad, but the AC:L rating is optimistic: exploiting the race window between scx_sub_disable() and root disable's drain_descendants() requires precise timing, making practical exploitation substantially harder than a straightforward low-complexity bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local user with at least low-privilege access on a system running a Linux 7.1.x or earlier kernel with sched_ext sub-schedulers active could craft a sequence of BPF scheduler enable requests timed to coincide with an ongoing parent scheduler disable operation. By racing scx_sub_disable() against root disable's all-task teardown during the narrow window before drain_descendants() can impose ordering, the attacker triggers the task walk on a dying hierarchy, corrupting kernel memory via use-after-free and potentially escalating to ring-0 execution. …
Remediation	The primary remediation is to upgrade to a patched kernel version: Linux 7.1.9 (stable) or Linux 7.2 (next stable), both of which include the fix per EUVD data. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, consult vendor security advisory to identify affected Linux kernel versions and audit infrastructure to inventory vulnerable systems, prioritizing by business criticality and scope of local user access. …

Threat intelligence, references, and detailed analysis are available after sign-in.