CVE-2026-46154: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46154 Overview

CVE-2026-46154 is a use-after-free (UAF) vulnerability in the Linux kernel's sched_ext (SCX) subsystem. The flaw resides in the cgroup setter routines scx_group_set_weight(), scx_group_set_idle(), and scx_group_set_bandwidth(). These functions cache the scx_root pointer before acquiring scx_cgroup_ops_rwsem, allowing the pointer to become stale before the operation executes. If the loaded scheduler is disabled and freed via RCU work while another scheduler is enabled between the naked load and the rwsem acquisition, the reader dereferences the freed scheduler object. The issue was resolved by reading scx_root inside the rwsem read section to correlate the scheduler pointer with the scx_cgroup_enabled snapshot.

Critical Impact
A race between sched_ext scheduler swap and cgroup attribute updates can dereference a freed scheduler object, leading to kernel memory corruption.

Affected Products

Linux kernel versions containing the sched_ext cgroup setter code paths prior to the upstream fix
Mainline and stable kernel branches tracked by kernel.org stable trees
Distribution kernels that have backported sched_ext without the corresponding fix

Discovery Timeline

2026-05-28 - CVE-2026-46154 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46154

Vulnerability Analysis

The vulnerability is a classic use-after-free triggered by a race condition in the sched_ext cgroup interface. Three setter routines, scx_group_set_weight(), scx_group_set_idle(), and scx_group_set_bandwidth(), read the global scx_root pointer outside of any synchronization primitive. They subsequently acquire scx_cgroup_ops_rwsem for read access and dispatch operations through the cached pointer using SCX_HAS_OP(sch, ...) and SCX_CALL_OP(sch, ...). Because scx_cgroup_enabled is toggled only under a write hold of scx_cgroup_ops_rwsem during scx_cgroup_init() and scx_cgroup_exit(), the enabled state and the live scx_root are not consistently observed by readers performing the naked load.

Root Cause

The root cause is improper synchronization between the load of scx_root and the read-side critical section of scx_cgroup_ops_rwsem. The cached pointer is captured before any lock is held. An RCU-deferred free of the previously loaded scheduler can complete between that load and the rwsem acquisition. When the setter then proceeds, scx_cgroup_enabled reflects the newly loaded scheduler while the dereferenced pointer references the freed predecessor, producing a UAF [CWE-416].

Attack Vector

Triggering the race requires the ability to write to cgroup attributes such as cpu.weight, cpu.idle, or bandwidth controls while a sched_ext scheduler swap occurs. On systems where unprivileged workloads control delegated cgroups, a local actor with cgroup write access could repeatedly attempt the race during scheduler reload events. Exploitation depends on winning a narrow window between the unsynchronized pointer load and the rwsem read acquisition.

No verified exploitation code is publicly associated with this CVE. The vulnerability is described in upstream commit messages referenced by the stable tree. Refer to the Kernel Git Commit Fix for the source-level change.

Detection Methods for CVE-2026-46154

Indicators of Compromise

Kernel oops or general protection fault traces referencing scx_group_set_weight, scx_group_set_idle, or scx_group_set_bandwidth in the call stack
KASAN reports indicating use-after-free on a scx_sched object during cgroup attribute writes
Kernel panics correlated in time with sched_ext scheduler load or unload events

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to surface UAF accesses on the freed scheduler object during fuzzing
Audit running kernel versions against the fixed commits 0f54f6355575, 80afd4c84bc8, and ce9aaa3af445 from the stable tree
Monitor dmesg for RCU stalls or scheduler subsystem warnings emitted near cgroup write operations

Monitoring Recommendations

Track sched_ext scheduler load and unload events through audit logs and correlate with cgroup writes
Alert on unexpected kernel crashes on hosts that load BPF-based sched_ext schedulers
Collect crash dumps from production hosts and inspect for stack frames inside kernel/sched/ext.c

How to Mitigate CVE-2026-46154

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 0f54f6355575, 80afd4c84bc8, and ce9aaa3af445
Update to a distribution kernel that includes the sched_ext synchronization fix
Restrict the ability to load and unload sched_ext schedulers to trusted administrators only

Patch Information

The fix moves the read of scx_root inside the scx_cgroup_ops_rwsem read section so that the pointer is observed atomically with the scx_cgroup_enabled state. The patch is available in the stable tree at the Kernel Git Commit Fix, with related changes in the Kernel Git Commit Update and Kernel Git Commit Change.

Workarounds

Disable CONFIG_SCHED_CLASS_EXT in kernel builds where sched_ext is not required
Avoid runtime swapping of sched_ext schedulers on production systems until patched
Limit cgroup delegation so untrusted workloads cannot write to cpu.weight, cpu.idle, or bandwidth files

bash

# Verify kernel includes the sched_ext fix
uname -r
grep -E 'CONFIG_SCHED_CLASS_EXT' /boot/config-$(uname -r)

# Optional: disable sched_ext at boot via kernel cmdline
# Append the following to GRUB_CMDLINE_LINUX in /etc/default/grub
#   sched_ext.disable=1
sudo update-grub