In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
scx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring
scx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs.
If the loaded scheduler is disabled and freed (via RCU work) and another is
enabled between the naked load and the rwsem acquire, the reader sees
scx_cgroup_enabled=true (the new scheduler's) but dereferences the freed one
- UAF on SCX_HAS_OP(sch, ...) / SCX_CALL_OP(sch, ...).
scx_cgroup_enabled is toggled only under scx_cgroup_ops_rwsem write
(scx_cgroup_{init,exit}), so reading scx_root inside the rwsem read section
correlates @sch with the enabled snapshot.
References
Configurations
Configuration 1 (hide)
|
History
09 Jun 2026, 20:59
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/0f54f6355575971673d8aac7da107ec4178e45bd - Patch | |
| References | () https://git.kernel.org/stable/c/80afd4c84bc8f5e80145ce35279f5ce53f6043db - Patch | |
| References | () https://git.kernel.org/stable/c/ce9aaa3af445c391735c9d000c4db60dfd5640d4 - Patch | |
| First Time |
Linux linux Kernel
Linux |
|
| CWE | CWE-416 |
30 May 2026, 11:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.0 |
28 May 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-28 10:16
Updated : 2026-06-09 20:59
NVD link : CVE-2026-46154
Mitre link : CVE-2026-46154
CVE.ORG link : CVE-2026-46154
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free