In the Linux kernel, the following vulnerability has been resolved: sched/cache: Introduce task_struct->sched_cache_grp to fix UAF Add a… (CVE-2026-98866)

The Linux kernel scheduler had a use-after-free vulnerability related to accessing the sched_cache_group via the mm_struct pointer. To fix this, a sched_cache_grp pointer was added directly to the task_struct, allowing the scheduler code to access the cache group without going through mm->sched_cache_grp. This decoupling prevents use-after-free conditions when account_mm_sched() accesses the group through a task whose mm is being switched. Reference counting for sched_cache_group was also improved by managing references separately in fork, exec, and exit paths, with new helper functions added to centralize this logic.

The vulnerability could lead to use-after-free conditions in the scheduler code, potentially causing kernel crashes or undefined behavior. The fix eliminates this risk by ensuring proper reference management and decoupling access paths, improving kernel stability and security.

An official fix has been implemented in the Linux kernel by introducing task_struct->sched_cache_grp and refactoring reference management. Users should update to the fixed kernel versions once available. Patch status is confirmed as fixed in the vendor source. No additional mitigations are required beyond applying the official fix.