CVE-2026-46154

Technical summary

The vulnerability is a use-after-free (UAF) condition in the sched_ext cgroup setter functions—specifically scx_group_set_weight(), scx_group_set_idle(), and scx_group_set_bandwidth(). These functions retrieve the scx_root pointer before acquiring the scx_cgroup_ops_rwsem read lock. During the window between the naked load and lock acquisition, a concurrent operation can disable the loaded scheduler (triggering RCU-delayed freeing) and enable a new one. The reader then observes scx_cgroup_enabled=true (from the new scheduler) but dereferences the freed scheduler object when executing SCX_HAS_OP() and SCX_CALL_OP() macros. The fix ensures scx_root is read only within the scx_cgroup_ops_rwsem read-critical section, so the cached scheduler pointer remains consistent with the enabled state throughout the operation.

Business impact

Local attackers with non-root privileges can trigger this race condition to crash the kernel or potentially execute arbitrary code with elevated privileges. The attack requires timing precision but no special capabilities beyond standard process execution. Systems running production workloads that use sched_ext (custom schedulers for specialized workloads, containers, or real-time applications) face service disruption and potential data exposure if the vulnerability is exploited before patching.

Affected systems

Linux kernel versions that include the sched_ext subsystem are affected. The sched_ext feature is an experimental framework introduced in newer kernel versions for pluggable schedulers. Systems running long-term stable or distribution kernels should verify whether sched_ext is compiled and enabled in their kernel configuration; many default deployments do not yet include this feature. Affected users should check their kernel version and configuration against vendor advisories and security updates.

Exploitability

Exploitation requires local access and unprivileged user privileges (PR:L in the CVSS vector). The attack complexity is rated as high (AC:H) because it requires precise timing to trigger the race condition between the naked load and lock acquisition. However, a determined attacker could use repeated attempts or event scheduling to increase success probability. No public exploit code is known at this time, but the vulnerability is not particularly complex once understood. Mitigations are limited for affected systems pending patches.

Remediation

Apply a kernel update containing the fix for CVE-2026-46154. The patch moves the scx_root read operation inside the scx_cgroup_ops_rwsem read-critical section, eliminating the race window. Verify the specific patched kernel version against your Linux distribution's security advisory. Interim mitigation on systems without sched_ext compiled or enabled is not required. If sched_ext is disabled in the kernel configuration, the vulnerability cannot be triggered.

Patch guidance

Obtain the patched kernel from your distribution's security repository or from kernel.org once fixes are released. Distributions typically backport security fixes to multiple supported kernel versions; verify which versions in your support lifecycle receive updates. After patching, reboot systems to load the fixed kernel. Test in a staging environment first to ensure compatibility with custom kernel modules or specialized configurations. For organizations using sched_ext for production workloads, prioritize testing before deploying to critical systems.

Detection guidance

Monitor system logs for kernel panics, general protection faults, or warnings related to RCU callbacks and scheduler operations. Memory sanitizers (KASAN, MSAN) in testing environments will flag UAF access attempts. Kernel debugging tools like perf and ftrace can correlate cgroup weight/bandwidth adjustments with scheduler enable/disable events to identify race condition attempts. Intrusion detection systems should flag patterns of repeated cgroup modifications under load, though this may generate false positives on legitimate workloads. Detection is difficult without kernel instrumentation because the race leaves no userspace artifacts.

Why prioritize this

This vulnerability merits high priority due to its HIGH CVSS score (7.0) and the confluence of factors: it provides a local privilege escalation path, requires only standard user privileges to trigger, and directly compromises kernel memory safety. Although exploitation requires precise timing (AC:H), the impact is severe—kernel crash or code execution. Organizations using sched_ext should prioritize patching immediately. Even those not actively using sched_ext should evaluate their kernel configuration and apply updates in their regular patch cycles to maintain defense-in-depth.

Risk score, explained

CVSS 3.1 score of 7.0 (HIGH) reflects: local attack vector (AV:L) because it requires local system access; high complexity (AC:H) due to the race condition's timing sensitivity; low privilege requirement (PR:L) since unprivileged users can trigger it; no user interaction (UI:N); confidentiality, integrity, and availability all high-impact (C:H/I:H/A:H) because the UAF can enable kernel code execution or crash. The severity is not critical because exploitation is not trivial and depends on sched_ext being enabled, but it crosses the threshold for immediate patching in affected environments.

Frequently asked questions