CVE-2026-98385

Executive Summary

CVE-2026-98385 is a use-after-free (UAF) vulnerability in the Linux kernel scheduler's cache-grouping subsystem, reported to the upstream kernel development community and originally detected through KASAN testing. The flaw arises because per-task scheduling cache statistics (sched_cache_stat) are stored inside the mm_struct address-space object, so the lifetime of those statistics is coupled to the lifetime of the memory descriptor. When a task switches to a new mm on one CPU while account_mm_sched() accesses task->mm->sc_stat on another CPU, the function can dereference an old mm that has already been freed, producing a use-after-free. Impact depends entirely on the local kernel's heap layout and the attacker's existing code-execution primitive: the corruption is triggered from a scheduler accounting path reachable during normal context-switch activity, meaning any local unprivileged process able to force concurrent mm teardown and scheduling accounting could attempt to turn the UAF into memory corruption or privilege escalation. No public proof-of-concept, no exploit code, no CISA KEV listing, and no EPSS score are available, and no patch has been tracked from any source.

Technical Analysis

The vulnerability class is a classic cross-CPU lifetime/locking race that degenerates into a use-after-free (CWE-416). The upstream description is explicit about the root cause and the remediation design, which allows a fairly precise class-level reconstruction without inventing implementation detail.

Data structure coupling. Scheduling cache grouping in the affected kernels is keyed by the mm (memory descriptor) of a task, and the associated scheduling statistics object — sched_cache_stat — lives inside the mm_struct. That placement means the statistics object's lifetime is bound to the address space's lifetime: when an mm_struct is torn down (process exit, execve, or address-space replacement via mm switch), the embedded scheduling statistics are freed along with it.

Racy access path. The accounting routine account_mm_sched() reads the scheduling stats through task->mm->sc_stat. account_mm_sched() is invoked from the scheduling path, not from the task's own context on its own CPU. Consequently the task pointer read on one CPU may reference a task whose mm — or whose previous mm — is concurrently being replaced or released on another CPU. Concretely: a task may be switching its active memory descriptor on CPU A while CPU B is running account_mm_sched() and dereferencing the old mm via task->mm->sc_stat. If the old mm has already been freed by the time CPU B performs the dereference, CPU B performs an out-of-bounds/use-after-free read and, depending on how the fetched value is subsequently used in statistics accumulation, potentially a write to recycled memory.

Detection context. The description states the issue was found while running tests with KASAN, with a mailing-list link credited to a reporter named Hyunwoo. KASAN (Kernel Address Sanitizer) reporting a use-after-free in a scheduler accounting path is consistent with the mechanism above: a freed mm_struct slab object being accessed after mmput()/free on another CPU with no serialization between the free path and the accounting path.

Remediation design (as described upstream, not yet confirmed in any shipped release). Rather than serializing mm access by taking an extra rq (runqueue) lock on the mm free path — which would add lock contention to a hot path — the upstream fix decouples the object:

1. sched_cache_stat is extracted out of mm_struct and renamed sched_cache_group.
2. The sched_cache_group object receives its own life cycle, managed by its own reference counting, independent of mm_struct.
3. A refcount is taken on the sched_cache_group when a task links to it, so the object cannot be freed while any task still references it.
4. This permits a follow-up patch to access sched_cache_group directly from the task rather than through task->mm, eliminating the dereference of a stale, released mm during mm switches.

The description also notes a secondary architectural benefit: cache grouping could later be associated with user-defined groupings, cgroups, cookie groups, or numa_group rather than being tied to a single mm address space. The description also references a rename of sched_cache_stat / sched_cache_group terminology, consistent with the restructuring above.

Attack surface. The vulnerable primitive is local-only. Triggering it requires the ability to create concurrency between scheduling/accounting activity and the teardown or replacement of an mm — for example, thread creation and rapid teardown, execve-driven address-space replacement, or address-space switching on multi-CPU systems. No network-reachable surface is implied by the description.

Exploitability caveats. The severity of this issue is bounded by how deterministic the stale dereference is and whether the freed object is attacker-influenceable. A read-only UAF in an accounting path is typically a denial-of-service (KASAN splat, kernel crash) rather than a direct privilege-escalation primitive; a UAF that yields a controlled statistic update on recycled slab memory is more dangerous. The upstream description does not state which of these applies beyond confirming the UAF and confirming that "stale and released old mm and its sched cache stat" can be accessed.

Exploitation Scenarios

No public proof-of-concept or exploit code exists for CVE-2026-98385, and the CNA/NVD description does not disclose a concrete trigger sequence beyond the general race. The following attack chain is therefore inferred strictly at the vulnerability-class level, using only the components named in the description. No function names, file paths, or parameters beyond those in the description are asserted.

1. Reconnaissance / target identification. This is a local kernel privilege-escalation class vulnerability, not a remote one. An adversary with existing low-privilege code execution on a target host (e.g., an unprivileged user, a sandboxed workload, or an attacker-controlled container process sharing the kernel) identifies the affected kernel by version and by the presence of the sched_cache_stat-in-mm_struct design. No remote exposure exists to fingerprint externally.

2. Triggering the specific flaw class. The attacker must create a window in which one CPU is executing the scheduler accounting path (account_mm_sched() accessing task->mm->sc_stat) while another CPU is concurrently tearing down or replacing the same task's mm. At the class level this means driving high concurrency between address-space replacement/teardown operations and scheduler activity — for example, rapidly creating and destroying threads or repeatedly replacing the process address space while the scheduler accounts for the task on another CPU. Because the statistics live inside mm_struct, the teardown of the mm frees the statistics, and the concurrent accounting access dereferences memory that has already been released.

3. Payload / execution method. The payload is not a network string or file; it is a race-window manipulation from a local process. The attacker's objective is to schedule the racing operations so that account_mm_sched() executes against the freed mm_struct/embedded statistics object. If the operation performed on that stale pointer is a write into the now-freed (and potentially reallocated) slab object, the attacker's payload becomes a heap-manipulation primitive; if the access is a pure read, the immediate outcome is a kernel fault / KASAN use-after-free report, i.e., denial of service.

4. Post-exploitation impact. If the stale access is read-only or the slab object was not reclaimed by attacker-controlled data, the outcome is a kernel crash (DoS / availability loss). If the freed mm_struct-derived memory is reclaimed by an object the attacker can shape, the write/read into recycled memory becomes a corruption primitive that could be escalated into local privilege escalation or a sandbox escape, depending on the surrounding heap grooming the attacker can perform. The provided data does not confirm which outcome is achievable and does not provide a working chain.

Impact Assessment

• Confidentiality: A stale read of a freed mm-derived object can leak memory contents into scheduling statistics, but the provided data does not describe an information-disclosure path to user space. Treat confidentiality impact as low-to-unspecified.
• Integrity: The dangerous case is a statistic update performed against recycled memory, which is memory corruption. Whether writes (rather than reads) occur on the stale pointer is not stated in the description, so integrity impact is unresolved but potentially high in the worst case.
• Availability: A use-after-free in a core scheduler accounting path is at minimum a kernel fault/crash candidate, giving a local denial-of-service impact. KASAN having detected the bug confirms the memory-safety violation is real and reachable.
• Privilege boundary: The flaw is in the kernel scheduler and is reachable from ordinary local task activity. In a multi-tenant kernel-sharing environment (containers, sandboxes), that places the trust boundary at the container/host or user/kernel boundary. No CVSS vector or score was assigned by NVD, EPSS has not scored it, and the issue is not in CISA KEV, so no quantitative severity is asserted here.
• Blast radius: Any system running an affected kernel where tasks can be created/destroyed and where address spaces are replaced concurrently across CPUs. Because the fix is a kernel-wide redesign of the scheduling-group lifetime, the affected range spans the kernel releases that introduced and retained the mm-coupled sched_cache_stat design; the precise version boundaries are not available in the provided data.

Detection Guidance

Detection for a local kernel UAF is primarily host-based (kernel logs, KASAN, crash/panic telemetry, and syscall-rate anomalies), supplemented by network rules that will only fire if a secondary toolchain is used to deliver the trigger remotely (e.g., via SSH or a build system). The rules below are conservative and keyed to the observable artifacts of this class of bug rather than to a real, known exploit.

Sigma Rule

title: Local Kernel Scheduler Use-After-Free Trigger Indicators (CVE-2026-98385 class)
id: 5f1f7a2e-3c8b-4c1a-9e2d-7c0a1b2d3e4f
status: experimental
description: Detects kernel log and crash artifacts consistent with a use-after-free in the Linux scheduler cache-grouping / mm accounting path (CVE-2026-98385 class).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98385
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: kernel
detection:
  selection_kasan:
    - 'KASAN'
    - 'use-after-free'
    - 'account_mm_sched'
    - 'sched_cache_stat'
    - 'sched_cache_group'
  selection_mm:
    - 'BUG: KASAN: use-after-free'
    - 'mm_struct'
    - 'slab-out-of-bounds'
  condition: selection_kasan or selection_mm
falsepositives:
  - Legitimate KASAN-enabled development/testing kernels
  - Unrelated kernel memory-safety bugs reported by the same sanitizer
level: medium

YARA Rule

rule CVE_2026_98385_Linux_Sched_UAF_Strings
{
    meta:
        description = "Detects kernel images, crash dumps, or logs referencing the sched cache-grouping mm use-after-free (CVE-2026-98385 class)."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98385"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"

    strings:
        $s1 = "account_mm_sched" ascii wide
        $s2 = "sched_cache_stat" ascii wide
        $s3 = "sched_cache_group" ascii wide
        $s4 = "mm_struct" ascii wide
        $s5 = "use-after-free" ascii nocase

    condition:
        (uint32(0) == 0x464c457f) and 2 of ($s1, $s2, $s3, $s4, $s5)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 22 (msg:"CVE-2026-98385 Linux kernel scheduler UAF trigger delivery via SSH (possible)"; flow:to_server,established; content:"account_mm_sched"; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; sid:202698385; rev:1;)

Note: CVE-2026-98385 has no network-reachable surface. The Suricata rule above is a best-effort content match for a remote delivery channel (e.g., an attacker pushing a compiled trigger over SSH) and will not detect local exploitation directly.

Elastic Detection

process where host.os.type == "linux" and
  event.category == "process" and
  process.name in ("bash", "sh", "python3", "gcc", "cc")
  and process.parent.name in ("sshd", "systemd")
  and process.args_count > 0 and
  (process.args : "*account_mm_sched*" or
   process.args : "*sched_cache_stat*" or
   process.args : "*sched_cache_group*")

Note: This EQL rule targets the realistic case in which an attacker compiles or references kernel scheduler symbols while preparing a local trigger. On most hosts this will produce false positives from legitimate kernel developers; tune to known build hosts.

Splunk SPL Query

index=linux_kernel sourcetype=syslog
| search "KASAN" OR "use-after-free" OR "account_mm_sched" OR "sched_cache_stat" OR "sched_cache_group"
| stats count min(_time) as first_seen max(_time) as last_seen by host, message
| where count > 0
| table host, first_seen, last_seen, count, message

Wazuh OSSEC Rule

<group name="linux,kernel,memory_safety,">
  <rule id="2029850" level="12">
    <decoded_as>syslog</decoded_as>
    <match>KASAN|use-after-free|sched_cache_stat|sched_cache_group|account_mm_sched</match>
    <description>CVE-2026-98385 class: possible Linux kernel scheduler use-after-free reported by kernel sanitizer</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, no commit hash, no stable-version mapping, and no workaround has been recorded. The upstream description defines the intended fix design but does not establish that a fix has shipped in any released kernel.

1. Immediate mitigations.

• Treat this as a local attack-surface issue: reduce the number of untrusted processes that share the same kernel and that can race thread creation/teardown and address-space replacement. Enforce least privilege so that unprivileged local users cannot freely spawn and destroy threads at high rates; where practical, use seccomp/namespace/nested-isolation controls to limit concurrency from untrusted workloads.
• Monitor kernel logs aggressively for KASAN splats, BUG:, use-after-free, or mm_struct-related fault strings. A detected occurrence is itself evidence of an active trigger and should be treated as a potential attempted privilege escalation, not just a nuisance crash.
• Enable crash-dump collection where feasible so that any UAF-related panic can be forensically analyzed for a trigger pattern.
• If a specific thread-creation/teardown workload is observed to induce the crash on a given host, isolate or rate-limit that workload as a stopgap.

2. Patch / upgrade steps.

• No patch is currently tracked. Apply upstream and distribution kernel updates as soon as the fix — the sched_cache_group life-cycle decoupling described upstream — is backported to the stable and vendor kernels in use. Because patch confidence is 0/4, verify patch status directly against the upstream stable tree and the vendor security advisory rather than assuming a fix exists.
• After any kernel update, run regression and stress tests under KASAN if a test kernel is available to confirm the use-after-free no longer reproduces.

3. Long-term hardening.

• Adopt a kernel-maintenance cadence that pins to supported stable branches and subscribes to upstream stable and distribution security feeds for scheduler and memory-management fixes.
• Run KASAN (and where appropriate KFENCE/KCSAN) on CI/test hardware for any custom kernel build so this class of race is caught before production.
• Reduce architectural reliance on kernel-shared multi-tenancy where the workload does not require it; strong container/microVM boundaries reduce the blast radius of local kernel UAFs without requiring the kernel fix to be first.

References

1. NVD — CVE-2026-98385: https://nvd.nist.gov/vuln/detail/CVE-2026-98385
2. Linux kernel mailing list — KASAN report / discussion referenced in the NVD description (apPb-Dr4nPYuHQOK@v4bel): https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/
3. Linux Kernel Address Sanitizer (KASAN) documentation — the detection mechanism that surfaced this bug: https://docs.kernel.org/dev-tools/kasan.html
4. MITRE ATT&CK — T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
5. CWE-416 — Use After Free: https://cwe.mitre.org/data/definitions/416.html

No threat-actor campaign, exploit-in-the-wild evidence, or CISA KEV listing is associated with CVE-2026-98385 at the time of writing.