sched_ext CgroupOps UAF

Vulnerability analysis

The vulnerability occurs in sched_ext cgroup setter functions (scx_group_set_weight, scx_group_set_idle, scx_group_set_bandwidth) that cache the scx_root pointer before acquiring the scx_cgroup_ops_rwsem read lock. A race condition exists where the scheduler can be disabled and freed via RCU work, and another scheduler enabled, between the naked scx_root load and the rwsem acquire. The code then sees scx_cgroup_enabled=true from the new scheduler but dereferences the freed old scheduler structure in SCX_HAS_OP() and SCX_CALL_OP(), resulting in a use-after-free. The fix moves the scx_root read inside the rwsem read section to correlate the pointer with the enabled-state snapshot. Exploitation requires winning a narrow timing window against a concurrent scheduler disable/enable operation.