CVE-2026-74731: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74731 Overview

CVE-2026-74731 is a use-after-free vulnerability in the Linux kernel's sched_ext (extensible scheduler) subsystem. The flaw exists in the sub-scheduler disable path, where a race between root disable and a never-linked sub-scheduler's teardown can re-home already-exited tasks onto a dying scheduler hierarchy. Local attackers with the ability to load or interact with sched_ext sub-schedulers can trigger memory corruption in kernel context. The vulnerability requires local access and low privileges, and impacts confidentiality, integrity, and availability of affected systems.

Critical Impact
Local privilege escalation and kernel memory corruption through a race condition in scx_sub_disable() that operates on unlinked sub-schedulers, leading to use-after-free on exited tasks.

Affected Products

Linux kernel builds with CONFIG_SCHED_CLASS_EXT enabled
Distributions shipping kernels that include the sched_ext sub-scheduler hierarchy feature
Systems running BPF-based custom schedulers via sched_ext

Discovery Timeline

2026-08-22 - CVE-2026-74731 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74731

Vulnerability Analysis

The vulnerability resides in the sched_ext sub-scheduler enable and disable logic. When a sub-scheduler enable operation fails before scx_link_sched() links the sub-scheduler into the hierarchy, the cleanup path still executes the full scx_sub_disable() routine. This is a Use-After-Free condition triggered by a race with root disable.

The function drain_descendants() provides the only ordering guarantee between a sub-scheduler's disable-time task walk and root disable's all-task teardown. An unlinked sub-scheduler is invisible to drain_descendants() because it never entered the hierarchy. This visibility gap allows root teardown to run between the never-linked sub-scheduler's drain and its subsequent task walk.

As a result, every task can be exited to no scheduler before the walk executes. The walk then trips the membership WARN and re-homes the exited tasks onto the dying hierarchy, producing a use-after-free on freed task-scheduler state.

Root Cause

The root cause is missing state validation in the cleanup path. The scx_sub_disable() routine unconditionally performs cgroup ownership reset and a task walk even when the sub-scheduler @sch was never linked. The empty ->sibling list indicates the never-linked state, and unlinking otherwise occurs later in the same function.

Attack Vector

Exploitation requires local access and the ability to invoke sched_ext sub-scheduler enable operations, typically through BPF-based scheduler loading. An attacker races a failing sub-scheduler enable against a root disable operation. Successful timing corrupts kernel task-scheduler state and can be leveraged for local privilege escalation or denial of service.

The upstream fix skips the cgroup ownership reset and the task walk when @sch was never linked, detected by checking whether ->sibling is empty. See the kernel commits 6428093a4a98 and 8c13364db9c9 for the patch.

Detection Methods for CVE-2026-74731

Indicators of Compromise

Kernel WARN splats referencing sched_ext membership checks or task re-homing during sub-scheduler teardown.
Unexpected kernel oops or panic traces containing scx_sub_disable, drain_descendants, or scx_link_sched frames.
Repeated failures in loading or enabling BPF-based sched_ext sub-schedulers on production hosts.

Detection Strategies

Monitor kernel ring buffer output via dmesg and centralized log collection for sched_ext-related warnings or use-after-free reports from KASAN-enabled kernels.
Audit which users and processes hold CAP_BPF or CAP_SYS_ADMIN and can load BPF scheduler programs via bpf(2).
Track bpf(2) syscall activity, particularly BPF_PROG_LOAD calls targeting scheduler program types, to identify unusual sub-scheduler enable attempts.

Monitoring Recommendations

Ingest kernel logs and auditd telemetry into a centralized data lake to correlate BPF loading events with kernel warnings.
Alert on kernel crashes or reboots that coincide with sched_ext activity from non-administrative accounts.
Establish baselines for legitimate sched_ext usage so anomalous sub-scheduler churn stands out.

How to Mitigate CVE-2026-74731

Immediate Actions Required

Apply the upstream stable kernel updates containing commits 6428093a4a98 and 8c13364db9c9 as soon as distribution packages are available.
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted administrative accounts to reduce the local attacker surface.
Inventory hosts where CONFIG_SCHED_CLASS_EXT is enabled and prioritize patching for multi-tenant or shared-user systems.

Patch Information

The Linux kernel maintainers resolved this issue by skipping the cgroup ownership reset and task walk when the sub-scheduler was never linked. The relevant fixes are available in the mainline and stable trees via Kernel Git Commit 6428093 and Kernel Git Commit 8c13364d. Rebuild or install a kernel package that incorporates both commits and reboot affected systems.

Workarounds

Disable sched_ext at boot by building or selecting a kernel without CONFIG_SCHED_CLASS_EXT where custom schedulers are not required.
Prevent unprivileged BPF program loading by setting kernel.unprivileged_bpf_disabled=1 via sysctl.
Remove CAP_BPF from non-administrative users and containers to block sub-scheduler enable attempts.

bash

# Configuration example
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/60-harden-bpf.conf