Linux Kernel UAF: Unbalanced css_put in cgroup init
CVE-2026-43438 Published on May 8, 2026
sched_ext: Remove redundant css_put() in scx_cgroup_init()
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Remove redundant css_put() in scx_cgroup_init()
The iterator css_for_each_descendant_pre() walks the cgroup hierarchy
under cgroup_lock(). It does not increment the reference counts on
yielded css structs.
According to the cgroup documentation, css_put() should only be used
to release a reference obtained via css_get() or css_tryget_online().
Since the iterator does not use either of these to acquire a reference,
calling css_put() in the error path of scx_cgroup_init() causes a
refcount underflow.
Remove the unbalanced css_put() to prevent a potential Use-After-Free
(UAF) vulnerability.
Products Associated with CVE-2026-43438
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 8195136669661fdfe54e9a8923c33b31c92fc1da and below cc095cd305fddbe25a968e4a78436ff9476cf0f6 is affected.
- Version 8195136669661fdfe54e9a8923c33b31c92fc1da and below 6eaaa67d6998f6c30c462b140db8c062e07ec473 is affected.
- Version 8195136669661fdfe54e9a8923c33b31c92fc1da and below bf50f3285eda8a0173625fcdb5f183f96e1008cd is affected.
- Version 8195136669661fdfe54e9a8923c33b31c92fc1da and below 1336b579f6079fb8520be03624fcd9ba443c930b is affected.
- Version 6.12 is affected.
- Before 6.12 is unaffected.
- Version 6.12.78, <= 6.12.* is unaffected.
- Version 6.18.19, <= 6.18.* is unaffected.
- Version 6.19.9, <= 6.19.* is unaffected.
- Version 7.0, <= * is unaffected.