---
id: CVE-2026-98866
title: 'sched/cache: Introduce task_struct->sched_cache_grp to fix UAF'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched/cache: Introduce task_struct->sched_cache_grp to fix UAF

  Add a sched_cache_grp pointer to task_struct so that scheduler code
  can access the cache group directly …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= df0d98475954d655571979aa061ecb07d7e00392 <
    9436130e6da72af63289a4acb3aa0c1df07a3928
  - >-
    Linux >= df0d98475954d655571979aa061ecb07d7e00392 <
    b636fef85bda7d1bab9c0a45067ab1508d79d946
  - Linux 7.2
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:51:27.883Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98866'
references:
  - url: 'https://git.kernel.org/stable/c/9436130e6da72af63289a4acb3aa0c1df07a3928'
  - url: 'https://git.kernel.org/stable/c/b636fef85bda7d1bab9c0a45067ab1508d79d946'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.458Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sched/cache: Introduce task_struct->sched_cache_grp to fix UAF

Add a sched_cache_grp pointer to task_struct so that scheduler code
can access the cache group directly via the task, without going
through mm->sched_cache_grp.  This decouples the scheduler's hot-path
accesses from the mm_struct.

Each task holds its own refcount on the sched_cache_group, separate
from the reference held by its mm_struct.  The reference is acquired
in copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm().
This fixes the use-after-free when account_mm_sched() reaches the group
through a task whose mm is being switched, as reported by Hyunwoo:

  https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/

Convert all scheduler code in fair.c and exit.c to use
p->sched_cache_grp instead of p->mm->sched_cache_grp.

Keep the fork/exec/exit reference management out of the generic mm
paths: add sched_cache_fork(), sched_cache_fork_cleanup(),
sched_cache_exec_mmap() and sched_cache_exit_mm() in
kernel/sched/cache_sched.c (with empty stubs for !CONFIG_SCHED_CACHE),
so fs/exec.c, kernel/fork.c and kernel/exit.c each call one helper
instead of open-coding the refcounting under #ifdef.  Also add
sched_cache_group_get() and task_cache_group_get().

## Affected

- `Linux >= df0d98475954d655571979aa061ecb07d7e00392 < 9436130e6da72af63289a4acb3aa0c1df07a3928`
- `Linux >= df0d98475954d655571979aa061ecb07d7e00392 < b636fef85bda7d1bab9c0a45067ab1508d79d946`
- `Linux 7.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.