---
id: CVE-2026-98385
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched/cache: Decouple sched_cache_group from mm to fix UAF

  Currently the sched cache grouping is by mm and the scheduling statistics
  sched_cache_stat lives in the mm s…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sched/cache: Decouple sched_cache_group from mm to fix UAF

  Currently the sched cache grouping is by mm and the scheduling statistics
  sched_cache_stat lives in the mm s…
severity: high
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T06:17:00.547'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98385'
references:
  - url: 'https://git.kernel.org/stable/c/28f9c0e0a0b94c5d3e1b634db545f6e1f94858c5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/852ecb6bc0bc0106f44f74ba3944524732486025'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98385.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98385'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2549480'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98385'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98385'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98385.mbox
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-10-12T14:50:34.093Z'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= df0d98475954d655571979aa061ecb07d7e00392 <
    852ecb6bc0bc0106f44f74ba3944524732486025
  - >-
    Linux >= df0d98475954d655571979aa061ecb07d7e00392 <
    28f9c0e0a0b94c5d3e1b634db545f6e1f94858c5
  - Linux 7.2
epss: 0.00177
epssPercentile: 0.07214
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/ylh440104/InfinityCore-Android-CVE-2026-98385'
  checkedAt: '2026-10-27T19:25:30.157Z'
exploitAvailable: true
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-825
scores:
  cna: 7.8
  vendor: 7
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sched/cache: Decouple sched_cache_group from mm to fix UAF

Currently the sched cache grouping is by mm and the scheduling statistics
sched_cache_stat lives in the mm structure.  This ties the life cycle
of scheduling stats with mm.

In account_mm_sched(), the scheduling stats are accessed by
task->mm->sc_stat.  However, a task may be switching mm on one CPU when
another CPU is running account_mm_sched(), and possibly accessing the
old mm that was freed.  This problem was found when running tests with
KASAN by Hyunwoo:

  https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/

Instead of serializing the mm access by introducing extra acquisition of
rq lock in the mm free path, extract sched_cache_stat from mm_struct,
rename it as sched_cache_group and manage its life cycle apart from
mm_struct with its own ref counting.  This allows us in the next patch
access sched_cache_group directly from task, and add a refcount
on sched_cache_group when a task links to it. This prevents the use
after free issue when accessing stale and released old mm and its
sched cache stat a task switches to a new mm while account_mm_sched()
is done elsewhere.

The other benefit of this restructure is in the future, the grouping of
tasks to a LLC would have the flexibility to be associated with a user
defined grouping, or cgroup, cookie group, numa_group or others instead
of just with a single mm address space.

Rename sched_cache_stat to sched_cache_group and turn it into a refcounted
object allocated from mm_struct.  The mm_struct now holds a pointer
(sched_cache_grp) to this object instead of embedding it.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98385.json)