CVE-2026-74731: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-74731 is a use-after-free vulnerability in the Linux kernel's sched_ext (extensible scheduler) subsystem, specifically in the handling of sub-scheduler teardown for schedulers that were never linked into the hierarchy. The flaw was published on August 22, 2026, and affects Linux kernel version 7.1 (versions prior to 7.1 are unaffected). Fixed versions include Linux kernel 7.1.9 and 7.2. No official CVSS score has been assigned by NVD at time of publication; Feedly estimates the severity as Medium (Github Advisory, Feedly).

The root cause is a race condition (use-after-free, CWE-416) in kernel/sched/ext/ext.c. When a sub-scheduler enable fails before scx_link_sched() links it into the scheduler hierarchy, the cleanup path still executes the full scx_sub_disable() routine. Because drain_descendants() is the only synchronization point between a sub-scheduler's disable-time task walk and the root scheduler's all-task teardown, an unlinked sub-scheduler is invisible to this ordering. The root's teardown can therefore run between the never-linked sub's drain and its task walk, causing every task to exit to no scheduler; the subsequent walk then re-homes those exited tasks onto the dying hierarchy, triggering a use-after-free. The fix skips the cgroup ownership reset and task walk when the scheduler was never linked, detectable by an empty ->sibling field (Github Advisory, Kernel Patch 1, Kernel Patch 2).

Successful exploitation can result in kernel memory corruption or a kernel crash (denial of service) due to the use-after-free condition. A local attacker with sufficient privileges to interact with the sched_ext subsystem could trigger this race condition by forcing a sub-scheduler initialization failure, potentially leading to system instability or, in more severe scenarios, privilege escalation through controlled memory corruption. The impact is confined to the local system; there is no indication of remote exploitability (Feedly, Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-74731. The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to trigger specific scheduler initialization failure conditions, which significantly limits the attacker population (Feedly).

Update the Linux kernel to version 7.1.9 or later in the 7.1.x stable series, or upgrade to kernel 7.2 or newer, which contain the upstream fix. The patches are available at the official kernel stable repository (commits 6428093a4a986c38c9089b5eb32b56d914ef437a and 8c13364db9c9a43ed286f3a8d0fb9477b1adc43c). If immediate patching is not possible, limiting local user access to sched_ext interfaces can reduce exposure. Linux distributions shipping kernel 7.1 should monitor their vendor channels for backported security updates (Kernel Patch 1, Kernel Patch 2, Github Advisory).