CVE-2026-98385

In the Linux kernel, the following vulnerability has been resolved:

sched/cache: Decouple sched cache group from mm to fix UAF

Currently the sched cache grouping is by mm and the scheduling statistics sched cache stat lives in the mm structure. This ties the life cycle of scheduling stats with mm.

In account mm sched(), the scheduling stats are accessed by task->mm->sc stat. However, a task may be switching mm on one CPU when another CPU is running account mm sched(), and possibly accessing the old mm that was freed. This problem was found when running tests with KASAN by Hyunwoo:

Instead of serializing the mm access by introducing extra acquisition of rq lock in the mm free path, extract sched cache stat from mm struct, rename it as sched cache group and manage its life cycle apart from mm struct with its own ref counting. This allows us in the next patch access sched cache group directly from task, and add a refcount on sched cache group when a task links to it. This prevents the use after free issue when accessing stale and released old mm and its sched cache stat a task switches to a new mm while account mm sched() is done elsewhere.

The other benefit of this restructure is in the future, the grouping of tasks to a LLC would have the flexibility to be associated with a user defined grouping, or cgroup, cookie group, numa group or others instead of just with a single mm address space.

Rename sched cache stat to sched cache group and turn it into a refcounted object allocated from mm struct. The mm struct now holds a pointer (sched cache grp) to this object instead of embedding it.