Security readout for executives and security teams
Plain-English summary
A race condition in Linux sched_ext can leave the kernel using a scheduler object after it has been freed. A locally authenticated, low-privilege user may be able to trigger memory corruption, potentially affecting confidentiality, integrity, or availability. Exploitation requires difficult timing conditions, but shared or multi-user Linux systems warrant prompt review.
Executive priority
Treat this as a high-priority kernel update for multi-user and shared infrastructure. Internet exposure alone does not create the stated attack path, but local footholds could increase impact. Schedule remediation promptly after confirming vendor applicability; isolated single-user systems may be handled through the normal urgent patch cycle.
Technical view
The cgroup weight, idle, and bandwidth setters cached scx_root before acquiring scx_cgroup_ops_rwsem. Scheduler replacement could then free that object through RCU while enabling another scheduler. The enabled flag could describe the new scheduler while operations dereferenced the stale pointer, causing a use-after-free. The fix reads scx_root within the semaphore-protected section.
Likely exposure
Exposure requires an affected Linux kernel and relevant sched_ext cgroup operations during scheduler replacement. The bundle lists 6.18, 6.18.32, 7.0.7, and 7.1 among affected identifiers, but its version encoding is ambiguous. Confirm exact distribution builds with vendor advisories or commit ancestry rather than relying solely on version strings.
Exploitation context
The CVSS vector indicates local access, low privileges, high attack complexity, and no user interaction. Potential confidentiality, integrity, and availability impacts are rated high. The CVE is not listed as KEV, and the supplied sources provide no evidence of public or active exploitation.
Researcher notes
The vulnerability is a locking and lifetime-correlation failure involving scx_root, scx_cgroup_enabled, RCU-delayed freeing, and scx_cgroup_ops_rwsem. No CWE is assigned in the bundle. The three referenced stable commits appear to represent fixes for kernel branches, but the bundle does not map them to specific distribution packages.
Mitigation direction
- Install a supported vendor kernel containing the applicable referenced stable fix.
- Check distribution security guidance for exact fixed package versions and any vendor-specific mitigation.
- Prioritize shared compute, container-hosting, and other systems permitting untrusted local users.
- Limit untrusted local access until affected systems are updated.
Validation and detection
- Record each system's running kernel build and distribution package revision.
- Check whether sched_ext is supported, enabled, or actively used on each host.
- Compare vendor package status or kernel commit ancestry against the referenced fixes.
- Review kernel crash records for scheduler-related use-after-free symptoms, without treating absence as proof of safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-46154 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ce9aaa3af445c391735c9d000c4db60dfd5640d4CVE reference, Linux
- https://git.kernel.org/stable/c/0f54f6355575971673d8aac7da107ec4178e45bdCVE reference, Linux
- https://git.kernel.org/stable/c/80afd4c84bc8f5e80145ce35279f5ce53f6043dbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.