# CVE-2026-98866: Linux kernel use-after-free in scheduler cache group access

Source: https://junglewise.ai/threats/cve-2026-98866-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-18  
License: CC BY 4.0 with a link back

CVE-2026-98866 · Severity: info · Published 2026-10-18

The Linux kernel's scheduler cache-aware load balancing feature contained a use-after-free vulnerability when processes switched memory contexts. An attacker could trigger this by rapidly forking or executing processes, potentially causing kernel memory corruption or a denial of service. The fix decouples scheduler cache lookups from the process memory structure to eliminate the race condition.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-98866 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-98866 being exploited in the wild.

**How severe is CVE-2026-98866?** Informational severity, published 18 October 2026.

**Which products and versions are affected?** Linux Kernel CONFIG_SCHED_CACHE enabled; fixed in 7.2.x and later stable series.

**Is there a fix for CVE-2026-98866?** Yes: fixed in Linux 7.2.x stable series and later; upstream fix commit b636fef85bda7d1bab9c0a45067ab1508d79d946. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-98866 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-98866?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Linux 7.2.x stable series and later; upstream fix commit b636fef85bda7d1bab9c0a45067ab1508d79d946

## Technical details

A use-after-free vulnerability exists in the scheduler's cache group accounting when a task's memory management structure (mm_struct) is switched during execution. The scheduler code previously accessed the cache group via mm->sched_cache_grp, but this reference could become invalid when the mm_struct was reassigned in exec_mmap() or similar operations. The fix adds a per-task sched_cache_grp pointer with independent reference counting, eliminating the dependency on mm_struct lifetime.

## Affected products

- Linux Linux kernel CONFIG_SCHED_CACHE enabled; fixed in 7.2.x and later stable series

## Timeline

- 2026-10-18: disclosed: Advisory published
- 2026-09-21: patched: Upstream fix in linux-next

## References

- [https://git.kernel.org/stable/c/9436130e6da72af63289a4acb3aa0c1df07a3928](https://git.kernel.org/stable/c/9436130e6da72af63289a4acb3aa0c1df07a3928)
- [https://git.kernel.org/stable/c/b636fef85bda7d1bab9c0a45067ab1508d79d946](https://git.kernel.org/stable/c/b636fef85bda7d1bab9c0a45067ab1508d79d946)

## Related threats

- [Linux kernel dm-pcache buffer over-read in segment processing](https://junglewise.ai/threats/cve-2026-98868-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel dm-pcache out-of-bounds write in cache key handling](https://junglewise.ai/threats/cve-2026-98867-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel sched_ext deadlock in ops.dequeue() with DSQ lock](https://junglewise.ai/threats/cve-2026-98865-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel sched_ext task reenqueue state synchronization](https://junglewise.ai/threats/cve-2026-98864-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel KVM nested state pages memory safety issue](https://junglewise.ai/threats/cve-2026-98863-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)