EUVD-2026-97241
GHSA-984h-v76f-94jc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local unprivileged execution
-
DeliverySpawn tasks that rapidly switch mm
-
ExploitRace account_mm_sched() against mm free
-
ExecutionDereference freed sched_cache stats (UAF)
-
ImpactCorrupt kernel memory for privilege escalation
Vulnerability Assessment
| Exploitation Conditions | Requires local access to run code on a Linux kernel built with the scheduler LLC cache-grouping feature (sched/cache) present in recent 7.2+ kernels - the vulnerable code does not exist in older kernels. The attacker-controlled trigger is forcing a task to switch its mm (via exec/fork/thread teardown) on one CPU while account_mm_sched() accesses that mm's sched cache stats on another CPU, so exploitation depends on winning this cross-CPU timing race. Limiting factors: no remote vector (local only), low-privileged local user suffices (PR:L), no user interaction needed, but success is gated by the tight race window and by the kernel actually enabling this scheduler feature, which narrows the realistically affected population to bleeding-edge deployments. |
| Impact | Signals point to a genuine but non-emergency local kernel flaw. The CVSS base score of 7.8 is driven entirely by local impact (AV:L, PR:L, S:U, C:H/I:H/A:H) - there is no remote vector, so an attacker must already have the ability to run code on the host. The multi-source signals are consistent in de-prioritizing it: EPSS is 0.14% (3rd percentile, i.e. very low predicted exploitation), there is no CISA KEV listing (not actively exploited), and no confirmed public exploit code. The vuln.today decision label is 'this_week' - treat as a routine prioritized patch, not a fire drill. One conflict worth flagging: the input vector states AC:L, but the kernel commit describes a use-after-free arising from a race (one CPU switching a task's mm while another CPU runs account_mm_sched() against the just-freed mm), which is a timing-dependent condition more consistent with AC:H and with the low EPSS; reliable weaponization of such a race is non-trivial. Net: a real priority for multi-user/multi-tenant and container hosts where untrusted local code runs, but low urgency for single-user or tightly controlled systems. |
| Exploit ScenarioDerived | A local unprivileged user on a shared Linux host (e.g. a container tenant or CI runner) runs a workload that rapidly creates and switches address spaces while scheduler cache accounting runs on other CPUs, racing account_mm_sched() against mm teardown to dereference freed memory. Winning the race corrupts kernel heap state, which a skilled attacker could shape toward privilege escalation. No confirmed public exploit code exists; a KASAN bug report demonstrating the crash is referenced on lore.kernel.org. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
Use-after-free in the Linux kernel sched/cache LLC grouping code can let a local attacker crash the kernel or potentially corrupt memory by racing a task mm switch against account_mm_sched() accessing the old mm's scheduling statistics. Only recent 7.2+ kernels that include the sched/cache feature are affected; the flaw is fixed in Linux 7.2.9 and 7.3-rc5. Exploitation requires local code execution and a tight cross-CPU timing window, EPSS is 0.14% (3rd percentile), and no public exploit has been identified at time of analysis.
RemediationAI
Vendor-released patch: Linux 7.2.9 and 7.3-rc5. Upgrade affected systems to Linux 7.2.9, 7.3-rc5, or a later release containing commits 28f9c0e0a0b94c5d3e1b634db545f6e1f94858c5 and 852ecb6bc0bc0106f44f74ba3944524732486025; patch status is available from vendor. No specific workaround is described in the supplied references, so applying the stable fixes is the complete remediation. Until patched, exposure is limited to systems running recent 7.2+ kernels with the sched/cache feature that permit untrusted local code execution; no remote vector is present. Vendor references: https://git.kernel.org/stable/c/28f9c0e0a0b94c5d3e1b634db545f6e1f94858c5, https://git.kernel.org/stable/c/852ecb6bc0bc0106f44f74ba3944524732486025, and https://seclists.org/oss-sec/2026/q4/211.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a use-after-free (CWE not supplied; the class is UAF) in the scheduler's cache-grouping code. sched_cache_stat was embedded in mm_struct and account_mm_sched() read task->mm->sc_stat; if a task switched mm on one CPU while another CPU ran account_mm_sched(), the old mm could be freed and its statistics accessed. The upstream fix extracts the statistics into a separately refcounted sched_cache_group object allocated from mm_struct, with mm_struct holding a pointer, so a task can hold a reference while it is linked to the group. The assessed vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: local, low-privileged, no user interaction, but high complexity because the cross-CPU race must be won, with high confidentiality, integrity, and availability impact if it is. The affected feature is present in recent 7.2+ kernels and absent from older kernels.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Commit describes a cross-CPU timing race so AC:H; a local unprivileged task triggers it giving AV:L/PR:L/UI:N; a kernel-heap UAF yields full C/I/A impact.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
sched/cache: Decouple sched_cache_group from mm to fix UAF
Currently the sched cache grouping is by mm and the scheduling statistics sched_cache_stat lives in the mm structure. This ties the life cycle of scheduling stats with mm.
In account_mm_sched(), the scheduling stats are accessed by task->mm->sc_stat. However, a task may be switching mm on one CPU when another CPU is running account_mm_sched(), and possibly accessing the old mm that was freed. This problem was found when running tests with KASAN by Hyunwoo:
https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/
Instead of serializing the mm access by introducing extra acquisition of rq lock in the mm free path, extract sched_cache_stat from mm_struct, rename it as sched_cache_group and manage its life cycle apart from mm_struct with its own ref counting. This allows us in the next patch access sched_cache_group directly from task, and add a refcount on sched_cache_group when a task links to it. This prevents the use after free issue when accessing stale and released old mm and its sched cache stat a task switches to a new mm while account_mm_sched() is done elsewhere.
The other benefit of this restructure is in the future, the grouping of tasks to a LLC would have the flexibility to be associated with a user defined grouping, or cgroup, cookie group, numa_group or others instead of just with a single mm address space.
Rename sched_cache_stat to sched_cache_group and turn it into a refcounted object allocated from mm_struct. The mm_struct now holds a pointer (sched_cache_grp) to this object instead of embedding it.
Executive ViewAI
CVE-2026-98385 is a high-severity (CVSS 7.8) use-after-free in the Linux kernel's sched/cache LLC grouping code, affecting only systems running Linux 7.2+ kernels. It requires local code execution to exploit, and there is no public exploit identified at time of analysis. Leadership should care because successful exploitation can crash the kernel or corrupt memory, impacting availability and potentially integrity, and any local user on affected systems could trigger it-though exploitation requires a tight timing window.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB