CVE-2026-46154

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46154", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.102Z", "datePublished": "2026-05-28T09:36:10.310Z", "dateUpdated": "2026-08-05T12:30:05.703Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:30:05.703Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters\n\nscx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring\nscx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs.\nIf the loaded scheduler is disabled and freed (via RCU work) and another is\nenabled between the naked load and the rwsem acquire, the reader sees\nscx_cgroup_enabled=true (the new scheduler's) but dereferences the freed one\n- UAF on SCX_HAS_OP(sch, ...) / SCX_CALL_OP(sch, ...).\n\nscx_cgroup_enabled is toggled only under scx_cgroup_ops_rwsem write\n(scx_cgroup_{init,exit}), so reading scx_root inside the rwsem read section\ncorrelates @sch with the enabled snapshot."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable setters are reached only by writing cgroup CPU control files (cpu.weight/idle/max) via the local filesystem/syscall interface; there is no network-reachable path.\nAC:H - The UAF requires a full scheduler disable\u2192RCU-free\u2192enable cycle to land within the window after the naked scx_root load; the unprivileged attacker reliably controls only the cgroup-write side, not the privileged scheduler-swap timing, so success cannot be achieved at will.\nPR:L - cpu.weight/cpu.idle/cpu.max are delegatable in cgroup v2, so an unprivileged user in a delegated subtree (common in container/systemd setups) can repeatedly invoke the setters that perform the stale dereference.\nUI:N - Triggering the setter requires only programmatic writes to cgroup files; no victim interaction is involved.\nS:U - The freed object and the corrupted control flow are both within the kernel's own security authority; no VM/IOMMU/sandbox boundary is crossed.\nC:H - The UAF reads the freed scx_sched (has_op bitmap and ops pointers); a reallocated, attacker-shaped object enables disclosure of freed/controlled kernel memory.\nI:H - The bug culminates in an indirect call through sch->ops.cgroup_*() on freed memory; heap-spraying the freed scx_sched yields a control-flow-hijack/arbitrary-write primitive.\nA:H - Dereferencing and calling through a freed scx_sched reliably causes an oops/panic, taking down the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/ext.c"], "versions": [{"version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d", "lessThan": "ce9aaa3af445c391735c9d000c4db60dfd5640d4", "status": "affected", "versionType": "git"}, {"version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d", "lessThan": "0f54f6355575971673d8aac7da107ec4178e45bd", "status": "affected", "versionType": "git"}, {"version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d", "lessThan": "80afd4c84bc8f5e80145ce35279f5ce53f6043db", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/sched/ext.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.32", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.32"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ce9aaa3af445c391735c9d000c4db60dfd5640d4"}, {"url": "https://git.kernel.org/stable/c/0f54f6355575971673d8aac7da107ec4178e45bd"}, {"url": "https://git.kernel.org/stable/c/80afd4c84bc8f5e80145ce35279f5ce53f6043db"}], "title": "sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/sched/ext.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ce9aaa3af445c391735c9d000c4db60dfd5640d4", "status": "affected", "version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d", "versionType": "git"}, {"lessThan": "0f54f6355575971673d8aac7da107ec4178e45bd", "status": "affected", "version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d", "versionType": "git"}, {"lessThan": "80afd4c84bc8f5e80145ce35279f5ce53f6043db", "status": "affected", "version": "a5bd6ba30b3364354269b81ac55c2edca9a96d6d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/sched/ext.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.32", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C29FBB84-11C5-4598-8812-17C64D98F7F9", "versionEndExcluding": "6.18.32", "versionStartIncluding": "6.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E", "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters\n\nscx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring\nscx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs.\nIf the loaded scheduler is disabled and freed (via RCU work) and another is\nenabled between the naked load and the rwsem acquire, the reader sees\nscx_cgroup_enabled=true (the new scheduler's) but dereferences the freed one\n- UAF on SCX_HAS_OP(sch, ...) / SCX_CALL_OP(sch, ...).\n\nscx_cgroup_enabled is toggled only under scx_cgroup_ops_rwsem write\n(scx_cgroup_{init,exit}), so reading scx_root inside the rwsem read section\ncorrelates @sch with the enabled snapshot."}], "id": "CVE-2026-46154", "lastModified": "2026-06-17T10:53:10.710", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-28T10:16:31.040", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0f54f6355575971673d8aac7da107ec4178e45bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/80afd4c84bc8f5e80145ce35279f5ce53f6043db"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ce9aaa3af445c391735c9d000c4db60dfd5640d4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters", "id": "2482520", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482520"}, "csaw": false, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel, specifically within the `sched_ext` component. This vulnerability, a use-after-free, occurs in the cgroup setters when the `scx_root` pointer is cached before a required lock is acquired. This can lead to a stale pointer if a scheduler is disabled and then re-enabled, allowing a local attacker to potentially cause a denial of service or achieve privilege escalation."], "name": "CVE-2026-46154", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46154\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46154\nhttps://lore.kernel.org/linux-cve-announce/2026052823-CVE-2026-46154-3357@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a5bd6ba30b3364354269b81ac55c2edca9a96d6d,ce9aaa3af445c391735c9d000c4db60dfd5640d4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a5bd6ba30b3364354269b81ac55c2edca9a96d6d,0f54f6355575971673d8aac7da107ec4178e45bd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a5bd6ba30b3364354269b81ac55c2edca9a96d6d,80afd4c84bc8f5e80145ce35279f5ce53f6043db)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.32,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.7,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-28T11:45:16.111035+00:00", "updated": "2026-06-09T23:45:15.700401+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}