The Linux kernel vulnerability involves the sched_ext subsystem where the scx_root pointer is read outside the protection of the scx_cgroup_ops_rwsem lock in cgroup setter functions (scx_group_set_weight, scx_group_set_idle, scx_group_set_bandwidth). Because the pointer is cached before acquiring the lock, if the scheduler is disabled and freed via RCU work and another scheduler is enabled between the pointer load and lock acquisition, a use-after-free occurs. The reader sees the new scheduler enabled flag but dereferences the freed scheduler pointer, causing a use-after-free on SCX_HAS_OP(sch, ...) and SCX_CALL_OP(sch, ...). The vulnerability affects Linux kernel versions prior to 7.0.0-28.28.1.

Successful exploitation can lead to a use-after-free condition in the kernel scheduler extension, potentially resulting in arbitrary code execution, privilege escalation, or system instability. The CVSS vector indicates local attack vector with high complexity and low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available in Linux kernel version 7.0.0-28.28.1 and later. Users should upgrade to this or a newer kernel version to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patch.