Linux Kernel cgroup v1/v2 Vulnerability Rated 7.8 CVSS

Status: UPDATED  |  Advisory ID: CVE-2026-74731

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Skip sub-disable teardown for never-linked sub-schedulers

A sub-scheduler enable can fail before scx_link_sched() links the sched into

the hierarchy, e.g. when the parent is already being disabled, and cleanup

still runs the full scx_sub_disable().

That is racy against root disable: drain_descendants() is the only ordering

between a sub's disable-time task walk and root disable's all-task teardown,

and an unlinked sub is invisible to it. Root's teardown can thus run between

the never-linked sub's drain and its walk, exiting every task to no

scheduler.

The walk then trips the membership WARN and re-homes the exited tasks onto

the dying hierarchy, a use-after-free.

Skip the cgroup ownership reset and the task walk if @sch was never linked,

indicated by the empty ->sibling as unlinking only happens later in the same

function. The membership WARN remains valid: a linked sub is always waited

on by an ancestor's drain. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References