vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-64226

sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path

HIGH
7.8
CVSS Score
Published: July 24, 2026 at 03:23 PM UTC
Updated: August 13, 2026 at 12:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error() dereferences p->comm and p->pid. If the iterator's reference is the last drop, the task is freed synchronously and the deref becomes a UAF. Move put_task_struct() past scx_error().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
6.12 ≤ v < 6.12.926.12 ≤ v < 6.18.346.12 ≤ v < 7.0.116.12 ≤ v < 7.16.13 ≤ v < 6.18.346.19 ≤ v < 7.0.117.1 rc17.1 rc27.1 rc3f0e1a0643a59bf1f922fa209cec86a170b784f3f
Vendor states this is fixed in 45c7c4e3db8b700307313c035ea08be829a7f21b (fixed)
Vendor states this is fixed in 57e19ba3f58a67eb924022a5a60b67fd08e5cbbd (fixed)
Vendor states this is fixed in 9a415cc53711f2238e0f0ca8a6bcc796c003b127 (fixed)
Vendor states this is fixed in cf396941901858b0de426cdcd3974eea6a02c98c (fixed)
Vendor states this is fixed in 6.12 (unaffected)
Vendor states this is fixed in 6.12.92 (unaffected)
Vendor states this is fixed in 6.18.34 (unaffected)
Vendor states this is fixed in 7.0.11 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

References (4)

Patch
Source: cverecord
https://git.kernel.org/stable/c/cf396941901858b0de426cdcd3974eea6a02c98c
Patch
Source: cverecord
https://git.kernel.org/stable/c/45c7c4e3db8b700307313c035ea08be829a7f21b
Patch
Source: cverecord
https://git.kernel.org/stable/c/57e19ba3f58a67eb924022a5a60b67fd08e5cbbd
Patch
Source: cverecord
https://git.kernel.org/stable/c/9a415cc53711f2238e0f0ca8a6bcc796c003b127

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusANALYZED
CWE
CWE-416

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card