HIGHCVE-2026-43438Published Modified CNA Linux
CVE-2026-43438: sched_ext: Remove redundant css_put() in scx_cgroup_init()
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Remove redundant css_put() in scx_cgroup_init() The iterator css_for_each_descendant_pre() walks the cgroup hierarchy under cgroup_lock(). It does not increment the reference counts on yielded css structs. According to the cgroup documentation, css_put() should only be used to release a reference obtained via css_get() or css_tryget_online(). Since the iterator does not use either of these to acquire a reference, calling css_put() in the error path of scx_cgroup_init() causes a refcount underflow. Remove the unbalanced css_put() to prevent a potential Use-After-Free (UAF) vulnerability.
Metrics
- CVSS v3.1
- 7.8
- Severity
- HIGH
- Fixed in
- 0
- Affected Products
- 2
Fix available
01336b579f6079fb8520be03624fcd9ba443c930b6.12.786.18.196.19.96eaaa67d6998f6c30c462b140db8c062e07ec4737.0bf50f3285eda8a0173625fcdb5f183f96e1008cdcc095cd305fddbe25a968e4a78436ff9476cf0f6
Affected packages
- Linux / Linux< cc095cd305fddbe25a968e4a78436ff9476cf0f6 (from 8195136669661fdfe54e9a8923c33b31c92fc1da) · < 6eaaa67d6998f6c30c462b140db8c062e07ec473 (from 8195136669661fdfe54e9a8923c33b31c92fc1da) · < bf50f3285eda8a0173625fcdb5f183f96e1008cd (from 8195136669661fdfe54e9a8923c33b31c92fc1da) · < 1336b579f6079fb8520be03624fcd9ba443c930b (from 8195136669661fdfe54e9a8923c33b31c92fc1da)
- Linux / Linux6.12Fixed in 0, 6.12.78, 6.18.19, 6.19.9, 7.0
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H