CVE-2026-43438

Summary

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Remove redundant css_put() in scx_cgroup_init()

The iterator css_for_each_descendant_pre() walks the cgroup hierarchy under cgroup_lock(). It does not increment the reference counts on yielded css structs.

According to the cgroup documentation, css_put() should only be used to release a reference obtained via css_get() or css_tryget_online(). Since the iterator does not use either of these to acquire a reference, calling css_put() in the error path of scx_cgroup_init() causes a refcount underflow.

Remove the unbalanced css_put() to prevent a potential Use-After-Free (UAF) vulnerability.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux8195136669661fdfe54e9a8923c33b31c92fc1da < cc095cd305fddbe25a968e4a78436ff9476cf0f6affected
LinuxLinux8195136669661fdfe54e9a8923c33b31c92fc1da < 6eaaa67d6998f6c30c462b140db8c062e07ec473affected
LinuxLinux8195136669661fdfe54e9a8923c33b31c92fc1da < bf50f3285eda8a0173625fcdb5f183f96e1008cdaffected
LinuxLinux8195136669661fdfe54e9a8923c33b31c92fc1da < 1336b579f6079fb8520be03624fcd9ba443c930baffected
LinuxLinux6.12affected
LinuxLinux0 < 6.12unaffected
LinuxLinux6.12.78 <= 6.12.*unaffected
LinuxLinux6.18.19 <= 6.18.*unaffected
LinuxLinux6.19.9 <= 6.19.*unaffected
LinuxLinux7.0 <= *unaffected

Weaknesses

References