CVE-2026-46154 (GCVE-0-2026-46154)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:36 – Updated: 2026-08-05 12:30
VLAI
Title
sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
Summary
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters scx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring scx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs. If the loaded scheduler is disabled and freed (via RCU work) and another is enabled between the naked load and the rwsem acquire, the reader sees scx_cgroup_enabled=true (the new scheduler's) but dereferences the freed one - UAF on SCX_HAS_OP(sch, ...) / SCX_CALL_OP(sch, ...). scx_cgroup_enabled is toggled only under scx_cgroup_ops_rwsem write (scx_cgroup_{init,exit}), so reading scx_root inside the rwsem read section correlates @sch with the enabled snapshot.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a5bd6ba30b3364354269b81ac55c2edca9a96d6d , < ce9aaa3af445c391735c9d000c4db60dfd5640d4 (git)
Affected: a5bd6ba30b3364354269b81ac55c2edca9a96d6d , < 0f54f6355575971673d8aac7da107ec4178e45bd (git)
Affected: a5bd6ba30b3364354269b81ac55c2edca9a96d6d , < 80afd4c84bc8f5e80145ce35279f5ce53f6043db (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.32 , ≤ 6.18.* (semver)
Unaffected: 7.0.7 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ce9aaa3af445c391735c9d000c4db60dfd5640d4",
              "status": "affected",
              "version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d",
              "versionType": "git"
            },
            {
              "lessThan": "0f54f6355575971673d8aac7da107ec4178e45bd",
              "status": "affected",
              "version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d",
              "versionType": "git"
            },
            {
              "lessThan": "80afd4c84bc8f5e80145ce35279f5ce53f6043db",
              "status": "affected",
              "version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.32",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters\n\nscx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring\nscx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs.\nIf the loaded scheduler is disabled and freed (via RCU work) and another is\nenabled between the naked load and the rwsem acquire, the reader sees\nscx_cgroup_enabled=true (the new scheduler\u0027s) but dereferences the freed one\n- UAF on SCX_HAS_OP(sch, ...) / SCX_CALL_OP(sch, ...).\n\nscx_cgroup_enabled is toggled only under scx_cgroup_ops_rwsem write\n(scx_cgroup_{init,exit}), so reading scx_root inside the rwsem read section\ncorrelates @sch with the enabled snapshot."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable setters are reached only by writing cgroup CPU control files (cpu.weight/idle/max) via the local filesystem/syscall interface; there is no network-reachable path.\nAC:H - The UAF requires a full scheduler disable\u2192RCU-free\u2192enable cycle to land within the window after the naked scx_root load; the unprivileged attacker reliably controls only the cgroup-write side, not the privileged scheduler-swap timing, so success cannot be achieved at will.\nPR:L - cpu.weight/cpu.idle/cpu.max are delegatable in cgroup v2, so an unprivileged user in a delegated subtree (common in container/systemd setups) can repeatedly invoke the setters that perform the stale dereference.\nUI:N - Triggering the setter requires only programmatic writes to cgroup files; no victim interaction is involved.\nS:U - The freed object and the corrupted control flow are both within the kernel\u0027s own security authority; no VM/IOMMU/sandbox boundary is crossed.\nC:H - The UAF reads the freed scx_sched (has_op bitmap and ops pointers); a reallocated, attacker-shaped object enables disclosure of freed/controlled kernel memory.\nI:H - The bug culminates in an indirect call through sch-\u003eops.cgroup_*() on freed memory; heap-spraying the freed scx_sched yields a control-flow-hijack/arbitrary-write primitive.\nA:H - Dereferencing and calling through a freed scx_sched reliably causes an oops/panic, taking down the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:05.703Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ce9aaa3af445c391735c9d000c4db60dfd5640d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f54f6355575971673d8aac7da107ec4178e45bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/80afd4c84bc8f5e80145ce35279f5ce53f6043db"
        }
      ],
      "title": "sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46154",
    "datePublished": "2026-05-28T09:36:10.310Z",
    "dateReserved": "2026-05-13T15:03:33.102Z",
    "dateUpdated": "2026-08-05T12:30:05.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46154",
      "date": "2026-08-18",
      "epss": "0.0012",
      "percentile": "0.02154"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46154\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-28T10:16:31.040\",\"lastModified\":\"2026-06-17T10:53:10.710\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters\\n\\nscx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring\\nscx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs.\\nIf the loaded scheduler is disabled and freed (via RCU work) and another is\\nenabled between the naked load and the rwsem acquire, the reader sees\\nscx_cgroup_enabled=true (the new scheduler\u0027s) but dereferences the freed one\\n- UAF on SCX_HAS_OP(sch, ...) / SCX_CALL_OP(sch, ...).\\n\\nscx_cgroup_enabled is toggled only under scx_cgroup_ops_rwsem write\\n(scx_cgroup_{init,exit}), so reading scx_root inside the rwsem read section\\ncorrelates @sch with the enabled snapshot.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/sched/ext.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a5bd6ba30b3364354269b81ac55c2edca9a96d6d\",\"lessThan\":\"ce9aaa3af445c391735c9d000c4db60dfd5640d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a5bd6ba30b3364354269b81ac55c2edca9a96d6d\",\"lessThan\":\"0f54f6355575971673d8aac7da107ec4178e45bd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a5bd6ba30b3364354269b81ac55c2edca9a96d6d\",\"lessThan\":\"80afd4c84bc8f5e80145ce35279f5ce53f6043db\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/sched/ext.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.32\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.7\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.18\",\"versionEndExcluding\":\"6.18.32\",\"matchCriteriaId\":\"C29FBB84-11C5-4598-8812-17C64D98F7F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.7\",\"matchCriteriaId\":\"D0893CA7-9AE6-4DFE-AC75-48967D73AD8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f54f6355575971673d8aac7da107ec4178e45bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/80afd4c84bc8f5e80145ce35279f5ce53f6043db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce9aaa3af445c391735c9d000c4db60dfd5640d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:41:09+00:00",
      "cve": "CVE-2026-46154",
      "id": "CVE-2026-46154",
      "initial_release_date": "2026-05-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46154.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:17:49Z",
      "cve": "CVE-2026-46154",
      "id": "CVE-2026-46154",
      "initial_release_date": "2026-05-29T01:16:09Z",
      "product_status:known_not_affected": "293",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46154",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46154.json",
      "version": "5"
    }
  }
}