CVE-2026-43438: sched_ext: Remove redundant css_put() in scx_cgroup_init()
In the Linux kernel, the following vulnerability has been resolved:
schedext: Remove redundant cssput() in scxcgroupinit()
The iterator cssforeachdescendantpre() walks the cgroup hierarchy under cgrouplock(). It does not increment the reference counts on yielded css structs.
According to the cgroup documentation, cssput() should only be used to release a reference obtained via cssget() or csstrygetonline(). Since the iterator does not use either of these to acquire a reference, calling cssput() in the error path of scxcgroupinit() causes a refcount underflow.
Remove the unbalanced cssput() to prevent a potential Use-After-Free (UAF) vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Patch the Linux kernel to remove the redundant/unbalanced css_put() calls in scx_cgroup_init() error handling so refcounts obtained via css_get() or css_tryget_online() are released only once (under cgroup_lock()).
Linux kernel (cgroup/sched_ext) Remove unbalanced css_put() in scx_cgroup_init() error path = Apply upstream code change: remove redundant css_put() to avoid refcount underflow and potential use-after-free
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43438?
CVE-2026-43438 has been classified with a low severity as it pertains to a code cleanup in the Linux kernel.
How do I fix CVE-2026-43438?
To fix CVE-2026-43438, update the Linux kernel to the latest version where the vulnerability has been addressed.
What is the impact of CVE-2026-43438 on system performance?
CVE-2026-43438 is unlikely to impact system performance as it involves the removal of redundant code.
Is CVE-2026-43438 exploitable?
CVE-2026-43438 is not considered exploitable in the traditional sense, as it does not provide a pathway for unauthorized access or privilege escalation.
What systems are affected by CVE-2026-43438?
CVE-2026-43438 affects the Linux kernel, thus impacting all systems running a vulnerable version of this kernel.