Executive brief
A vulnerability was identified in the Linux kernel's extensible scheduler (sched_ext) that could lead to a system crash or unpredictable behavior. The issue occurs when the system manages resource groups (cgroups) while switching between different task schedulers. If an exploit were successful, it could allow a local attacker to cause a kernel panic, potentially disrupting services or impacting system availability.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's sched_ext (Extensible Scheduler) framework within the cgroup setter functions: scx_group_set_weight(), scx_group_set_idle(), and scx_group_set_bandwidth(). The root cause is a race condition where the scx_root pointer is cached before the scx_cgroup_ops_rwsem semaphore is acquired. If a scheduler is disabled and freed via RCU while a new one is enabled during this window, the setter functions may dereference a stale, freed pointer. This can be triggered during cgroup configuration changes. The fix involves moving the scx_root read operation inside the read-side critical section of the semaphore to ensure the pointer remains valid during execution.
Affected products
- Linux Linux Kernel v6.18+
Timeline
- 2026-04-24: patched: Initial patch authored by Tejun Heo
- 2026-05-28: advisory: NVD publication date