High 7.8Published Jul 24, 2026

CVE-2026-64226sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path

Updated under an hour ago (Oct 27, 2026, 10:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error() dereferences p->comm and p->pid. If the iterator's reference is the last drop, the task is freed synchronously and the deref becomes a UAF. Move put_task_struct() past scx_error().

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f0e1a0643a59bf1f922fa209cec86a170b784f3f before cf396941901858b0de426cdcd3974eea6a02c98c; from f0e1a0643a59bf1f922fa209cec86a170b784f3f before 45c7c4e3db8b700307313c035ea08be829a7f21b; from f0e1a0643a59bf1f922fa209cec86a170b784f3f before 57e19ba3f58a67eb924022a5a60b67fd08e5cbbd; from f0e1a0643a59bf1f922fa209cec86a170b784f3f before 9a415cc53711f2238e0f0ca8a6bcc796c003b127	CNA record
linux linux_kernel linux:linux_kernel	from 6.12 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; 7.1; 7.1	NVD

References

References

https://git.kernel.org/stable/c/cf396941901858b0de426cdcd3974eea6a02c98c	patch
https://git.kernel.org/stable/c/45c7c4e3db8b700307313c035ea08be829a7f21b	patch
https://git.kernel.org/stable/c/57e19ba3f58a67eb924022a5a60b67fd08e5cbbd	patch
https://git.kernel.org/stable/c/9a415cc53711f2238e0f0ca8a6bcc796c003b127	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.