Bug 2506787 (CVE-2026-64226)

Summary: CVE-2026-64226 kernel: Linux kernel (sched_ext): Use-After-Free vulnerability in scx_root_enable_workfn()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's sched_ext component. This Use-After-Free (UAF) vulnerability occurs in the `scx_root_enable_workfn()` function. Specifically, `put_task_struct(p)` is called before `scx_error()` dereferences `p->comm` and `p->pid`, leading to a premature freeing of the task. A local attacker could exploit this to potentially achieve arbitrary code execution or privilege escalation.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-24 16:02:42 UTC 
In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path

In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error()
dereferences p->comm and p->pid. If the iterator's reference is the last
drop, the task is freed synchronously and the deref becomes a UAF.

Move put_task_struct() past scx_error().
Comment 1 Mauro Matteo Cascella 2026-07-28 09:30:43 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026072417-CVE-2026-64226-590d@gregkh/T