What’s Vulnerable › Vulnerabilities

CVE-2026-64226: sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-24 · updated 2026-08-13
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error() dereferences p->comm and p->pid. If the iterator's reference is the last drop, the task is freed synchronously and the deref becomes a UAF. Move put_task_struct() past scx_error().

Affected products

• Linux kernel: from 6.12 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1-rc1, 7.1-rc2, 7.1-rc3 — fixed in 6.12.92, 6.18.34, 7.0.11

How to fix

Upgrade to a fixed version: Linux kernel 6.12.92, 6.18.34, 7.0.11. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/45c7c4e3db8b700307313c035ea08be829a7f21b
• https://git.kernel.org/stable/c/57e19ba3f58a67eb924022a5a60b67fd08e5cbbd
• https://git.kernel.org/stable/c/9a415cc53711f2238e0f0ca8a6bcc796c003b127
• https://git.kernel.org/stable/c/cf396941901858b0de426cdcd3974eea6a02c98c

Get alerted when CVE-2026-64226 or the next vulnerability affects your stack