Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98385— sched/cache: Decouple sched_cache_group from mm to fix UAF

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： sched/cache：将 sched_cache_group 与 mm 解耦，以修复 Use-After-Free（UAF）漏洞 目前，调度缓存（sched cache）按进程描述符（mm）进行分组，调度统计信息 存储在 结构中。这使得调度统计信息的生命周期与 的生命周期紧密绑定。 在 函数中，调度统计信息通过 进行访问。然而，当一个 CPU 上的任务正在切换其 结构时，另一个 CPU 可能正在执行 ，并可能访问已被释放的旧 。Hyunwoo 在使用 KASAN（内核地址

AI Predicted 7.8 Difficulty: Hard EPSS 0.14% · P3

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 6

VendorProduct Version RangeStatus
Linux Linux df0d98475954d655571979aa061ecb07d7e00392< 852ecb6bc0bc0106f44f74ba3944524732486025 affected
df0d98475954d655571979aa061ecb07d7e00392< 28f9c0e0a0b94c5d3e1b634db545f6e1f94858c5 affected
7.2 affected
< 7.2 unaffected
7.2.9≤ 7.2.* unaffected
7.3-rc5≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98385

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
sched/cache: Decouple sched_cache_group from mm to fix UAF
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: sched/cache: Decouple sched_cache_group from mm to fix UAF Currently the sched cache grouping is by mm and the scheduling statistics sched_cache_stat lives in the mm structure. This ties the life cycle of scheduling stats with mm. In account_mm_sched(), the scheduling stats are accessed by task->mm->sc_stat. However, a task may be switching mm on one CPU when another CPU is running account_mm_sched(), and possibly accessing the old mm that was freed. This problem was found when running tests with KASAN by Hyunwoo: https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/ Instead of serializing the mm access by introducing extra acquisition of rq lock in the mm free path, extract sched_cache_stat from mm_struct, rename it as sched_cache_group and manage its life cycle apart from mm_struct with its own ref counting. This allows us in the next patch access sched_cache_group directly from task, and add a refcount on sched_cache_group when a task links to it. This prevents the use after free issue when accessing stale and released old mm and its sched cache stat a task switches to a new mm while account_mm_sched() is done elsewhere. The other benefit of this restructure is in the future, the grouping of tasks to a LLC would have the flexibility to be associated with a user defined grouping, or cgroup, cookie group, numa_group or others instead of just with a single mm address space. Rename sched_cache_stat to sched_cache_group and turn it into a refcounted object allocated from mm_struct. The mm_struct now holds a pointer (sched_cache_grp) to this object instead of embedding it.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux df0d98475954d655571979aa061ecb07d7e00392 ~ 852ecb6bc0bc0106f44f74ba3944524732486025 -
Linux Linux 7.2 -

II. Public POCs for CVE-2026-98385

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98385

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98385 (2)

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98385

No comments yet

Leave a comment