Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Remove redundant css_put() in scx_cgroup_init() The iterator css_for_each_descendant_pre() walks the cgroup hierarchy under cgroup_lock(). It does not increment the reference counts on yielded css structs. According to the cgroup documentation, css_put() should only be used to release a reference obtained via css_get() or css_tryget_online(). Since the iterator does not use either of these to acquire a reference, calling css_put() in the error path of scx_cgroup_init() causes a refcount underflow. Remove the unbalanced css_put() to prevent a potential Use-After-Free (UAF) vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 6.12, < 6.12.78 |
Related Weaknesses (CWE)
References
- https://git.kernel.org/stable/c/1336b579f6079fb8520be03624fcd9ba443c930bPatch
- https://git.kernel.org/stable/c/6eaaa67d6998f6c30c462b140db8c062e07ec473Patch
- https://git.kernel.org/stable/c/bf50f3285eda8a0173625fcdb5f183f96e1008cdPatch
- https://git.kernel.org/stable/c/cc095cd305fddbe25a968e4a78436ff9476cf0f6Patch
FAQ
What is CVE-2026-43438?
CVE-2026-43438 is a vulnerability with a CVSS score of 7.8 (HIGH). In the Linux kernel, the following vulnerability has been resolved: sched_ext: Remove redundant css_put() in scx_cgroup_init() The iterator css_for_each_descendant_pre() walks the cgroup hierarchy u...
How severe is CVE-2026-43438?
CVE-2026-43438 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-43438?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.