CVE-2026-64226 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error() dereferences p->comm and p->pid. If the iterator's reference is the last drop, the task is freed synchronously and the deref becomes a UAF.
Move put_task_struct() past scx_error().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability resides within the Linux kernel's scheduler extension subsystem, specifically in the scx_root_enable_workfn() function where a use-after-free condition can occur during initialization failure paths. This flaw represents a critical memory safety issue that arises from improper ordering of reference counting operations and error handling sequences. The problem manifests when the scheduler attempts to enable a root node but encounters an initialization failure, creating a scenario where task structure cleanup occurs prematurely before error reporting can safely access task metadata.
The technical implementation flaw stems from the incorrect sequence of operations within the error handling path of scx_root_enable_workfn(). When the system detects an initialization failure, it calls scx_error() which subsequently attempts to dereference p->comm and p->pid fields of a task structure. However, prior to this error reporting call, put_task_struct(p) is invoked, which can result in the immediate freeing of the task structure if no other references exist. This creates a classic use-after-free vulnerability where the memory location previously occupied by the task structure becomes accessible for reuse before the error reporting code completes its access patterns.
The operational impact of this vulnerability extends beyond simple memory corruption as it can potentially enable privilege escalation or system instability within the scheduler extension framework. Attackers could exploit this weakness to cause system crashes, data corruption, or in more sophisticated scenarios, achieve unauthorized privilege escalation by manipulating the freed memory contents during the error reporting phase. The vulnerability specifically affects systems running Linux kernels with scheduler extension support, making it relevant to high-performance computing environments and systems requiring advanced scheduling policies.
This issue aligns with CWE-416 which describes use-after-free vulnerabilities in software systems, and demonstrates characteristics consistent with ATT&CK technique T1059.003 related to command and scripting interpreter execution where memory corruption could enable attackers to execute arbitrary code through controlled memory manipulation. The fix implemented involves reordering the function calls to ensure put_task_struct() is executed after scx_error(), thereby guaranteeing that all error reporting operations complete before the task structure is potentially freed, thus preventing the use-after-free condition from occurring during initialization failure scenarios.
The mitigation strategy addresses the root cause by modifying the execution flow within the scheduler extension's error handling path. Moving the put_task_struct() call past the scx_error() invocation ensures proper lifecycle management of task structures during initialization failures. This change prevents the premature release of memory resources while maintaining the integrity of error reporting mechanisms. The fix represents a defensive programming approach that aligns with secure coding practices and helps prevent similar vulnerabilities in other kernel subsystems where reference counting and error handling interact. The solution maintains backward compatibility while eliminating the race condition that previously allowed for potential exploitation through memory corruption attacks.