CVE-2026-98220
N/AIn the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix NULL sched deref in kfunc sub-sched error paths When the root scheduler has sub-scheds attached, the COMPAT kfunc wrappers scx_bpf_select_cpu_and() and scx_bpf_dsq_insert_vtime() refuse the call and report to @p's scheduler: scx_error(scx_task_sched(p), "... must be used"); The wrappers are reachable with tasks that have no scheduler. scx_bpf_select_cpu_and() is in the select_cpu kfunc group, which scx_kfunc_context_filter() opens to BPF_PROG_TYPE_SYSCALL programs; scx_bpf_dsq_insert_vtime() is in the enqueue_dispatch group, which ops.enqueue() and ops.dispatch() may call with any KF_RCU task -- the group has no kf_tasks validation, and scx_dsq_insert_preamble() checks task ownership with scx_task_on_sched() precisely because @p may be an arbitrary task. scx_task_sched(p) is p->scx.sched, which is NULL for tasks past sched_ext_dead() -- which clears it via scx_disable_and_exit_task() on exit -- and for idle tasks, which the enable paths skip as they are never scheduled through SCX. It is also an rcu_dereference_protected() that expects @p's pi_lock or rq lock, which neither wrapper holds. Passing NULL to scx_error() reaches scx_vexit(), which dereferences sch->exit_info, oopsing the kernel. One concrete trigger exercised while developing the fix: a BPF_PROG_TYPE_SYSCALL program calling the select_cpu_and wrapper on an exited-but-not-reaped task while a sub-scheduler was attached (its pid stays findable while the zombie is unreaped; faulting instruction is the scx_vexit() prologue "mov r15,[rdi+0x398]" with RDI=NULL and 0x398 the offset of sch->exit_info): sched_ext: BPF scheduler "kfunc_subsched_null" enabled sched_ext: BPF sub-scheduler "kfunc_subsched_null" enabled sched_ext: Unassociated program run_select_cpu_ (id 76) BUG: kernel NULL pointer dereference, address: 0000000000000398 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 0 PID: 8201 Comm: kfunc_test_runn Tainted: G W RIP: 0010:scx_vexit+0x25/0xa0 Code: ... <4c> 8b bf 98 03 00 00 ... CR2: 0000000000000398 Call Trace: <TASK> __scx_exit+0x4f/0x70 scx_bpf_select_cpu_and+0xab/0xb0 bpf_prog_430ed61a7b66e03a_run_select_cpu_and+0x9c/0xe7 ? __x64_sys_bpf+0x2c/0x40 bpf_prog_test_run_syscall+0x130/0x2f0 __sys_bpf+0x930/0x10d0 ? __x64_sys_bpf+0x2c/0x40 __x64_sys_bpf+0x2c/0x40 do_syscall_64+0xbc/0x460 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Read @p's scheduler under RCU instead, which the wrappers can do from their guard(rcu)(): fault it when it can be determined, and when it can't be determined -- @p is a task past sched_ext_dead() or an idle task -- there is nothing obviously wrong to report, so just refuse the call as before without faulting any scheduler. These COMPAT wrappers are scheduled for eventual removal once the deprecation grace period elapses, but until then -- and regardless of their removal timeline -- they must not oops the kernel on a task they are handed.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 8th percentile
Impact if exploited
—CVSS · not scored
- No impact metrics
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
References and research data (JSON)
Vendor product assessments
Showing 32 of 277 vendor product statements; 245 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-64k-debug-modules-extra as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-64k-debug-modules-extra
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-debug-core as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-core
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-doc as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-doc
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-rt-64k-debug as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-debug
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-rt-64k-modules-extra as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-modules-extra
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-rt-debug-modules-extra as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-modules-extra
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-uki-virt as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-uki-virt
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel.src as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel?arch=src
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-debug as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00perf as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/perf
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-doc as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-doc
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-doc
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel.src as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel?arch=src
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-debug as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-ipaclones-internal as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-ipaclones-internal
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-devel
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-rt-modules-internal as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-modules-internal
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-zfcpdump-devel
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-64k as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-64k
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-64k-debug-modules-internal as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-64k-debug-modules-internal
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-abi-stablelists as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-abi-stablelists
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-debug-modules-extra as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-modules-extra
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-ipaclones-internal as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-ipaclones-internal
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-rt-64k-debug as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-debug
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-rt-64k-debug-modules-partner as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-debug-modules-partner
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-rt-64k-modules-partner as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-modules-partner
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-rt-debug-modules-extra as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-modules-extra
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-rt-modules-internal as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-modules-internal
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-uki-virt-addons as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-uki-virt-addons
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00kernel-zfcpdump-modules-partner as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-zfcpdump-modules-partner
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9
Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00
References
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98220.json Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93148 EUVD · EUVD-2026-93148
Technical & other
- https://git.kernel.org/stable/c/589f0945bf3ebf0790fd51e28c7f0d04ed3d8b78CVE record · Linux · Updated 2026-10-19T09:15:52.306Z
NVD · CVE-2026-98220 · Updated 2026-10-19T10:18:22.763 - https://git.kernel.org/stable/c/0a85182723b65ad8bee8131bc38fcf0347d6679bCVE record · Linux · Updated 2026-10-19T09:15:52.306Z
NVD · CVE-2026-98220 · Updated 2026-10-19T10:18:22.763 - https://access.redhat.com/security/cve/CVE-2026-98220 Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2546539 Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-98220 Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-98220 Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00
- https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98220.mbox Red Hat · CVE-2026-98220 · Updated 2026-10-09T09:05:53+00:00