CVE-2026-98385: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-98385 is a use-after-free (UAF) vulnerability in the Linux kernel's scheduler cache mechanism, specifically in the sched/cache subsystem. The flaw arises because sched_cache_stat is embedded in mm_struct, tying its lifecycle to the memory management structure; when a task switches mm contexts on one CPU while another CPU concurrently executes account_mm_sched(), the old mm — and its embedded sched_cache_stat — may already have been freed. The vulnerability affects Linux kernel version 7.2 (prior to 7.2.9 and 7.3-rc5). It was disclosed on October 12, 2026, with a CVSS v3.1 base score of 7.0 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-825 (Expired Pointer Dereference): sched_cache_stat is embedded directly in mm_struct, so its lifetime is bound to the mm object. In account_mm_sched(), the code accesses task->mm->sc_stat; however, if a task switches to a new mm on one CPU while account_mm_sched() runs on another CPU referencing the old mm, the old mm (and its sc_stat) may have already been freed, resulting in a UAF condition. The fix decouples sched_cache_stat from mm_struct by extracting it into a separately reference-counted object called sched_cache_group, so that tasks hold their own refcount on it independently of mm lifecycle. The vulnerability was originally discovered via KASAN testing by researcher Hyunwoo, as documented in the upstream LKML thread (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation by a local, low-privileged user could result in disclosure of sensitive kernel memory contents from the freed sched_cache_stat structure, kernel instability, or a system crash (denial of service). The attack requires local access and high complexity (e.g., triggering a race condition via process forking or exec operations that cause mm context switches), limiting its practical reach. Confidentiality, integrity, and availability are all rated as High impact in the CVSS scoring (GitHub Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is approximately 0.145%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

The Linux kernel has been patched in versions 7.2.9 and 7.3-rc5, with fixes available at upstream stable commits 852ecb6bc0bc and 28f9c0e0a0b9. Administrators should update to Linux kernel 7.2.9 or later as soon as possible. No configuration-based workaround is available; upgrading to a patched kernel version is the only recommended remediation (GitHub Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via Bugzilla (Bug 2549480) with medium priority and severity, and assigned it to their Product Security DevOps Team for triage. The original bug was identified through KASAN testing by researcher Hyunwoo, with the finding shared on the Linux kernel mailing list. No significant broader media coverage or notable public researcher commentary beyond the upstream kernel community has been observed (Red Hat Bugzilla).