CVE-2026-98385: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-984h-v76f-94jc
Share
Published
Advisory Summary

CVE-2026-98385 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98385 at a Glance

CVE Identifier CVE-2026-98385
GHSA Identifier GHSA-984h-v76f-94jc
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98385

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98385, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Decouple sched_cache_group from mm to fix UAF Currently the sched cache grouping is by mm and the scheduling statistics sched_cache_stat lives in the mm structure. This ties the life cycle of scheduling stats with mm. In account_mm_sched(), the scheduling stats are accessed by task->mm->sc_stat. However, a task may be switching mm on one CPU when another CPU is running account_mm_sched(), and possibly accessing the old mm that was freed. This problem was found when running tests with KASAN by Hyunwoo: https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/ Instead of serializing the mm access by introducing extra acquisition of rq lock in the mm free path, extract sched_cache_stat from mm_struct, rename it as sched_cache_group and manage its life cycle apart from mm_struct with its own ref counting. This allows us in the next patch access sched_cache_group directly from task, and add a refcount on sched_cache_group when a task links to it. This prevents the use after free issue when accessing stale and released old mm and its sched cache stat a task switches to a new mm while account_mm_sched() is done elsewhere. The other benefit of this restructure is in the future, the grouping of tasks to a LLC would have the flexibility to be associated with a user defined grouping, or cgroup, cookie group, numa_group or others instead of just with a single mm address space. Rename sched_cache_stat to sched_cache_group and turn it into a refcounted object allocated from mm_struct. The mm_struct now holds a pointer (sched_cache_grp) to this object instead of embedding it.

References

NVD — CVE-2026-98385 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98385
git.kernel.org/stable/c/28f9c0e0a0... WEB
https://git.kernel.org/stable/c/28f9c0e0a0b94c5d3e1b634db545f6e1f94858c5
git.kernel.org/stable/c/852ecb6bc0... WEB
https://git.kernel.org/stable/c/852ecb6bc0bc0106f44f74ba3944524732486025

Frequently Asked Questions

What is CVE-2026-98385?
CVE-2026-98385 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98385?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98385?
CVE-2026-98385 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98385?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-984h-v76f-94jc",
  "modified" : "2026-10-12T06:31:17Z",
  "published" : "2026-10-12T06:31:17Z",
  "aliases" : [ "CVE-2026-98385" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/cache: Decouple sched_cache_group from mm to fix UAF\n\nCurrently the sched cache grouping is by mm and the scheduling statistics\nsched_cache_stat lives in the mm structure.  This ties the life cycle\nof scheduling stats with mm.\n\nIn account_mm_sched(), the scheduling stats are accessed by\ntask->mm->sc_stat.  However, a task may be switching mm on one CPU when\nanother CPU is running account_mm_sched(), and possibly accessing the\nold mm that was freed.  This problem was found when running tests with\nKASAN by Hyunwoo:\n\n  https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/\n\nInstead of serializing the mm access by introducing extra acquisition of\nrq lock in the mm free path, extract sched_cache_stat from mm_struct,\nrename it as sched_cache_group and manage its life cycle apart from\nmm_struct with its own ref counting.  This allows us in the next patch\naccess sched_cache_group directly from task, and add a refcount\non sched_cache_group when a task links to it. This prevents the use\nafter free issue when accessing stale and released old mm and its\nsched cache stat a task switches to a new mm while account_mm_sched()\nis done elsewhere.\n\nThe other benefit of this restructure is in the future, the grouping of\ntasks to a LLC would have the flexibility to be associated with a user\ndefined grouping, or cgroup, cookie group, numa_group or others instead\nof just with a single mm address space.\n\nRename sched_cache_stat to sched_cache_group and turn it into a refcounted\nobject allocated from mm_struct.  The mm_struct now holds a pointer\n(sched_cache_grp) to this object instead of embedding it.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98385"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/28f9c0e0a0b94c5d3e1b634db545f6e1f94858c5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/852ecb6bc0bc0106f44f74ba3944524732486025"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-12T06:17:00Z"
  }
}