CVE-2026-46154 is a use-after-free vulnerability in the Linux kernel's scheduler extension (sched_ext). The vulnerability arises because the pointer scx_root is read outside the protection of the scx_cgroup_ops_rwsem lock in cgroup setter functions such as scx_group_set_weight, idle, and bandwidth. If the scheduler is disabled and freed via RCU work while another scheduler is enabled between the pointer load and lock acquisition, the code may dereference a freed scheduler structure, causing a use-after-free condition. This flaw can lead to high impact on confidentiality, integrity, and availability as indicated by the CVSS vector. The vulnerability affects multiple Linux kernel versions prior to 7.0.0-28.28 and related builds. Ubuntu has released patches in kernel versions 7.0.0-28.28 and later for various kernel flavors including generic, GCP, GKE, OEM, and realtime kernels. Users must update and reboot to apply the fix.

Successful exploitation of this use-after-free vulnerability could allow a local attacker with low privileges to cause a kernel crash or potentially escalate privileges by corrupting kernel memory. The CVSS score of 7.0 reflects a medium severity with high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

A patch is available and has been released by Ubuntu in kernel versions 7.0.0-28.28 and later for various kernel flavors. Users should update their Linux kernel packages to the fixed versions listed in the Ubuntu advisories USN-8566-1 and USN-8568-1 and reboot their systems to apply the fixes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigation steps are indicated by the vendor.