CVE-2026-98385: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98385 Overview

CVE-2026-98385 is a use-after-free (UAF) vulnerability in the Linux kernel's scheduler cache (sched/cache) subsystem. The flaw stems from tying the lifecycle of sched_cache_stat scheduling statistics directly to the mm_struct memory descriptor. When a task switches its mm on one CPU while another CPU executes account_mm_sched(), the latter can dereference a freed mm and its embedded scheduling statistics. The condition was discovered during Kernel Address Sanitizer (KASAN) testing. The fix decouples sched_cache_group from mm_struct and manages its lifecycle through independent reference counting.

Critical Impact
A race condition between task mm-switching and scheduler accounting allows kernel code to access freed memory, potentially leading to kernel memory corruption or information disclosure on multi-CPU Linux systems.

Affected Products

Linux kernel versions containing the sched_cache_stat implementation embedded in mm_struct
Upstream Linux kernel prior to the fix commits 28f9c0e and 852ecb6b
Downstream distributions shipping affected mainline kernel versions

Discovery Timeline

2026-10-12 - CVE-2026-98385 published to NVD
2026-10-12 - Last updated in NVD database

Technical Details for CVE-2026-98385

Vulnerability Analysis

The vulnerability resides in the Linux kernel scheduler's cache-aware scheduling accounting path. The function account_mm_sched() accesses scheduling statistics via task->mm->sc_stat. Because the sched_cache_stat structure is embedded inside mm_struct, its lifetime is bound to the memory descriptor. When one CPU frees an mm_struct as a task transitions to a new address space, another CPU running account_mm_sched() may still hold a reference to the stale descriptor. The resulting read or write targets freed slab memory.

KASAN flagged this concurrent access pattern during kernel testing. The race window exists on symmetric multiprocessing (SMP) systems where task mm-switching and scheduler accounting execute on separate CPUs without synchronization between them.

Root Cause

The root cause is lifecycle coupling between the scheduler's per-mm statistics and the mm_struct itself. The scheduler accounting path did not take a reference on the mm_struct before dereferencing sc_stat, and the mm free path did not serialize against concurrent scheduler accounting on other CPUs.

The upstream remediation extracts the statistics into a new sched_cache_group object with its own reference count. Tasks hold a refcount on sched_cache_group directly, which prevents its release while the scheduler reads or writes its fields. This also enables future flexibility to associate task grouping with cgroups, NUMA groups, or cookie groups rather than only an address space.

Attack Vector

Triggering the race requires local code execution capable of inducing rapid mm transitions, such as frequent exec() or exit() operations across threads scheduled on multiple CPUs. An attacker able to time these transitions against scheduler tick accounting can cause the kernel to dereference freed memory. The outcome depends on slab reuse timing and may include kernel panic, information leakage from reclaimed memory, or memory corruption useful for privilege escalation chains.

The vulnerability requires local access and the ability to execute code that influences process scheduling and memory descriptor lifetimes. Remote exploitation paths are not described in the referenced disclosure.

Detection Methods for CVE-2026-98385

Indicators of Compromise

KASAN splats in kernel logs referencing account_mm_sched or access to freed mm_struct memory
Unexpected kernel oops or panic traces originating in the scheduler cache accounting path
Soft lockups or crashes correlated with workloads performing high-frequency process creation and teardown

Detection Strategies

Enable KASAN on test kernels to surface the use-after-free during QA and staging workloads
Monitor dmesg and /var/log/kern.log for stack traces that reference sched_cache_stat, account_mm_sched, or mm_struct free paths
Correlate kernel crash telemetry with host inventory to identify unpatched kernel builds across the fleet

Monitoring Recommendations

Centralize kernel crash dumps and kdump output into a security data lake for cross-host correlation
Alert on repeated kernel oops events from the same host, especially under multi-threaded workloads
Track installed kernel versions as part of asset inventory to flag hosts missing the fix commits

How to Mitigate CVE-2026-98385

Immediate Actions Required

Identify Linux hosts running kernel versions prior to the fix commits 28f9c0e0a0b94c5d3e1b634db545f6e1f94858c5 and 852ecb6bc0bc0106f44f74ba3944524732486025
Prioritize patching multi-tenant hosts, container nodes, and systems that expose local code execution to untrusted users
Apply the stable kernel update from your distribution vendor as soon as it becomes available
Reboot affected systems after updating the kernel package to activate the fix

Patch Information

The fix is contained in two upstream commits that decouple sched_cache_group from mm_struct and introduce reference counting on the new object. See the Kernel Git Commit 28f9c0e and the Kernel Git Commit 852ecb6b for the authoritative source changes. Downstream distribution kernels should be updated to a build that includes both commits.

Workarounds

No supported configuration workaround exists; the race is inherent to the pre-patch scheduler accounting path
Reduce exposure by restricting local shell access and limiting unprivileged container workloads on affected kernels
Where patching is delayed, apply Linux Security Module (LSM) policies to constrain untrusted processes from spawning high-frequency exec/exit loops

bash

# Verify current kernel version and check for the fix
uname -r
zcat /proc/config.gz | grep CONFIG_SCHED_CACHE

# Example: update kernel on Debian/Ubuntu after vendor patch release
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')
sudo reboot