Decoupling Scheduling Cache from Memory Management in Linux Kernel

CVE-2026-98385

What is CVE-2026-98385?

A vulnerability exists in the Linux kernel due to the tight coupling of scheduling statistics with memory management structures. This architectural design flaw can lead to a use-after-free condition during task context switching. When a task switches its memory management (mm), another CPU might attempt to access stale scheduling statistics that have already been freed, potentially leading to erroneous behavior or crashes. The vulnerability was addressed by decoupling the scheduling cache group from the mm structure, enabling better management and lifecycle control via a reference counting mechanism. This patch not only mitigates the associated risks but also enhances flexibility for future task grouping configurations.

References