Linux kernel sched/cache: use-after-free on mm_struct when a task switches address space during account_mm_sched()

Impact

The LLC cache-aware scheduling statistics lived inside mm_struct, so their lifetime was tied to the address space. account_mm_sched() on one CPU could dereference task->mm->sc_stat while the task was switching mm on another CPU, reaching a freed mm - a use-after-free found with KASAN. The fix extracts the stats into a separately refcounted sched_cache_group. This is core scheduler code, so it is reachable on any host running an affected kernel with cache-aware scheduling, including GPU nodes, and does not depend on a device driver. Exposure is local only: it needs the ability to run processes on the node, which on a GPU fleet means any tenant with shell or container execution. The practical risk is a kernel crash taking the whole node and its in-flight training jobs with it; memory corruption from a UAF race is harder to steer but not excluded by the record.

Who can reach it

Local - any unprivileged user or container that can run processes and trigger address-space switches on the host. No special device access and no network reachability required. Not exploitable remotely.

What to do

Take a stable kernel containing commits 28f9c0e0a0b9 / 852ecb6bc0bc and reboot each node on the affected series - the fix is a structural change to mm_struct and the scheduler, not a tunable, so there is no runtime mitigation and no way to patch this without a kernel replacement. Plan it as a rolling drain-and-reboot across the fleet; for GPU nodes that means evacuating long-running training jobs first. The kernel git record does not name a distribution release.

References

Related entries

• ProFTPD mod_copy: unauthenticated SITE CPFR/CPTO gives arbitrary file read and writeCVE-2015-3306 · ProFTPD mod_copy (SITE CPFR / SITE CPTO)Critical
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• glibc through 2.29: heap buffer over-read in regexec during case-insensitive regex matchingCVE-2019-9169 · glibc regexec (proceed_next_node, case-insensitive matching)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• glibc 2.32/2.33: use-after-free in mq_notify of the caller's notification thread attributesCVE-2021-33574 · glibc mq_notify (POSIX message queue notification thread attributes)Critical