CVE-2026-43438

sched_ext: Remove redundant css_put() in scx_cgroup_init()

High · published May 8, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
6.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Remove redundant css_put() in scx_cgroup_init()

The iterator css_for_each_descendant_pre() walks the cgroup hierarchy

under cgroup_lock(). It does not increment the reference counts on

yielded css structs.

According to the cgroup documentation, css_put() should only be used

to release a reference obtained via css_get() or css_tryget_online().

Since the iterator does not use either of these to acquire a reference,

calling css_put() in the error path of scx_cgroup_init() causes a

refcount underflow.

Remove the unbalanced css_put() to prevent a potential Use-After-Free

(UAF) vulnerability.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00170 · 6.1th percentile
Published
2026-05-08T14:22Z
EPSS history
Timeline
  • 08 MAY 14:22Z
    sched_ext: Remove redundant css_put() in scx_cgroup_init()
    cvelistv5