CVE-2026-98866

In the Linux kernel, the following vulnerability has been resolved:

sched/cache: Introduce task struct->sched cache grp to fix UAF

Add a sched cache grp pointer to task struct so that scheduler code can access the cache group directly via the task, without going through mm->sched cache grp. This decouples the scheduler's hot-path accesses from the mm struct.

Each task holds its own refcount on the sched cache group, separate from the reference held by its mm struct. The reference is acquired in copy mm() (fork) and exec mmap() (exec), and released in exit mm(). This fixes the use-after-free when account mm sched() reaches the group through a task whose mm is being switched, as reported by Hyunwoo:

Convert all scheduler code in fair.c and exit.c to use p->sched cache grp instead of p->mm->sched cache grp.

Keep the fork/exec/exit reference management out of the generic mm paths: add sched cache fork(), sched cache fork cleanup(), sched cache exec mmap() and sched cache exit mm() in kernel/sched/cache sched.c (with empty stubs for !CONFIG SCHED CACHE), so fs/exec.c, kernel/fork.c and kernel/exit.c each call one helper instead of open-coding the refcounting under #ifdef. Also add sched cache group get() and task cache group get().