CVE-2026-46154: sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters

Synopsis

A use-after-free (UAF) vulnerability exists in the Linux kernel's extensible CPU scheduler (sched_ext) subsystem, specifically in cgroup weight, idle, and bandwidth setter functions. The flaw is reachable locally by a low-privileged user but requires a precise race window between a scheduler being disabled and a new one being enabled, placing it in the high-complexity category. Successful exploitation gives an attacker full read, write, and crash capability over the affected kernel context. A patched-image rebuild is available on HarborGuard for environments running affected kernel versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required.

• AuthenticationRequired

  A low-privilege local account is sufficient to trigger the race condition in the cgroup setter paths.

• Victim interactionNot required

  No user interaction is needed; the attacker exploits the race entirely through their own process.

• Attack complexityDetail

  Exploitation requires precise timing to win a race between a scheduler being torn down via RCU and a replacement being enabled, making reliable triggering dependent on environmental conditions.

Blast Radius

• A successful attacker can read arbitrary kernel memory, exposing sensitive data such as credentials, keys, or scheduler state held in the freed scheduler object.
• The attacker can corrupt or overwrite kernel memory through the dangling pointer, allowing modification of scheduler structures or other kernel data.
• Dereferencing the freed pointer can crash the kernel entirely, taking down the host and all workloads running on it.
• Because impact spans confidentiality, integrity, and availability at the kernel level, container isolation boundaries on the same host are at risk of being bypassed.