Is CVE-2026-98866 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-98866 being exploited in the wild.

How severe is CVE-2026-98866?

Informational severity, published 18 October 2026.

Which products and versions are affected?

Linux Kernel CONFIG_SCHED_CACHE enabled; fixed in 7.2.x and later stable series.

Is there a fix for CVE-2026-98866?

Yes: fixed in Linux 7.2.x stable series and later; upstream fix commit b636fef85bda7d1bab9c0a45067ab1508d79d946. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-98866 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-98866?

Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-98866: Linux kernel use-after-free in scheduler cache group access

CVE-2026-98866 · Severity: info · Published 2026-10-18

The Linux kernel's scheduler cache-aware load balancing feature contained a use-after-free vulnerability when processes switched memory contexts. An attacker could trigger this by rapidly forking or executing processes, potentially causing kernel memory corruption or a denial of service. The fix decouples scheduler cache lookups from the process memory structure to eliminate the race condition.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-98866 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-98866 being exploited in the wild.
How severe is CVE-2026-98866?: Informational severity, published 18 October 2026.
Which products and versions are affected?: Linux Kernel CONFIG_SCHED_CACHE enabled; fixed in 7.2.x and later stable series.
Is there a fix for CVE-2026-98866?: Yes: fixed in Linux 7.2.x stable series and later; upstream fix commit b636fef85bda7d1bab9c0a45067ab1508d79d946. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-98866 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-98866?: Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Linux 7.2.x stable series and later; upstream fix commit b636fef85bda7d1bab9c0a45067ab1508d79d946

Technical details

A use-after-free vulnerability exists in the scheduler's cache group accounting when a task's memory management structure (mm_struct) is switched during execution. The scheduler code previously accessed the cache group via mm->sched_cache_grp, but this reference could become invalid when the mm_struct was reassigned in exec_mmap() or similar operations. The fix adds a per-task sched_cache_grp pointer with independent reference counting, eliminating the dependency on mm_struct lifetime.

Affected products

Linux Linux kernel CONFIG_SCHED_CACHE enabled; fixed in 7.2.x and later stable series

Timeline

2026-10-18: disclosed: Advisory published
2026-09-21: patched: Upstream fix in linux-next

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.