CVE-2026-64226

Summary

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path

In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error() dereferences p->comm and p->pid. If the iterator's reference is the last drop, the task is freed synchronously and the deref becomes a UAF.

Move put_task_struct() past scx_error().

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxf0e1a0643a59bf1f922fa209cec86a170b784f3f < cf396941901858b0de426cdcd3974eea6a02c98caffected
LinuxLinuxf0e1a0643a59bf1f922fa209cec86a170b784f3f < 45c7c4e3db8b700307313c035ea08be829a7f21baffected
LinuxLinuxf0e1a0643a59bf1f922fa209cec86a170b784f3f < 57e19ba3f58a67eb924022a5a60b67fd08e5cbbdaffected
LinuxLinuxf0e1a0643a59bf1f922fa209cec86a170b784f3f < 9a415cc53711f2238e0f0ca8a6bcc796c003b127affected
LinuxLinux6.12affected
LinuxLinux0 < 6.12unaffected
LinuxLinux6.12.92 <= 6.12.*unaffected
LinuxLinux6.18.34 <= 6.18.*unaffected
LinuxLinux7.0.11 <= 7.0.*unaffected
LinuxLinux7.1 <= *unaffected

Weaknesses

References