---
id: CVE-2026-98385
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched/cache: Decouple sched_cache_group from mm to fix UAF

  Currently the sched cache grouping is by mm and the scheduling statistics
  sched_cache_stat lives in the mm s…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched/cache: Decouple sched_cache_group from mm to fix UAF

  Currently the sched cache grouping is by mm and the scheduling statistics
  sched_cache_stat lives in the mm s…
severity: none
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T06:17:00.547'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98385'
references:
  - url: 'https://git.kernel.org/stable/c/28f9c0e0a0b94c5d3e1b634db545f6e1f94858c5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/852ecb6bc0bc0106f44f74ba3944524732486025'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.093Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sched/cache: Decouple sched_cache_group from mm to fix UAF

Currently the sched cache grouping is by mm and the scheduling statistics
sched_cache_stat lives in the mm structure.  This ties the life cycle
of scheduling stats with mm.

In account_mm_sched(), the scheduling stats are accessed by
task->mm->sc_stat.  However, a task may be switching mm on one CPU when
another CPU is running account_mm_sched(), and possibly accessing the
old mm that was freed.  This problem was found when running tests with
KASAN by Hyunwoo:

  https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/

Instead of serializing the mm access by introducing extra acquisition of
rq lock in the mm free path, extract sched_cache_stat from mm_struct,
rename it as sched_cache_group and manage its life cycle apart from
mm_struct with its own ref counting.  This allows us in the next patch
access sched_cache_group directly from task, and add a refcount
on sched_cache_group when a task links to it. This prevents the use
after free issue when accessing stale and released old mm and its
sched cache stat a task switches to a new mm while account_mm_sched()
is done elsewhere.

The other benefit of this restructure is in the future, the grouping of
tasks to a LLC would have the flexibility to be associated with a user
defined grouping, or cgroup, cookie group, numa_group or others instead
of just with a single mm address space.

Rename sched_cache_stat to sched_cache_group and turn it into a refcounted
object allocated from mm_struct.  The mm_struct now holds a pointer
(sched_cache_grp) to this object instead of embedding it.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.