The vulnerability occurs in the Linux kernel's scheduler extension (sched_ext) where a sub-scheduler enable operation can fail before the sub-scheduler is linked into the scheduling hierarchy. If the parent scheduler is being disabled concurrently, the cleanup routine still runs the full sub-scheduler disable function (scx_sub_disable). Because the sub-scheduler was never linked, it is invisible to the root disable's task walk ordering, allowing the root teardown to run between the sub-scheduler's drain and task walk. This results in tasks being exited without a scheduler and subsequently re-homed onto a dying hierarchy, causing a use-after-free. The fix involves skipping the cgroup ownership reset and task walk for sub-schedulers that were never linked, preventing the use-after-free while maintaining valid warnings for linked sub-schedulers.

This vulnerability can cause kernel instability due to a use-after-free condition in the scheduler subsystem. While no direct exploit in the wild is known, the flaw could lead to system crashes or unpredictable behavior if triggered.

A fix has been applied in the Linux kernel to skip the teardown steps for sub-schedulers that were never linked, preventing the use-after-free condition. Users should update to the fixed kernel version once available. Since no patch links were provided, check the official Linux kernel advisories or distribution updates for the specific fix.