CVE-2026-43438: sched_ext: Remove redundant css_put() in scx_cgroup_init()
In the Linux kernel, the following vulnerability has been resolved:
schedext: Remove redundant cssput() in scxcgroupinit()
The iterator cssforeachdescendantpre() walks the cgroup hierarchy under cgrouplock(). It does not increment the reference counts on yielded css structs.
According to the cgroup documentation, cssput() should only be used to release a reference obtained via cssget() or csstrygetonline(). Since the iterator does not use either of these to acquire a reference, calling cssput() in the error path of scxcgroupinit() causes a refcount underflow.
Remove the unbalanced cssput() to prevent a potential Use-After-Free (UAF) vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.85-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.10-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43438?
CVE-2026-43438 has been classified with a low severity as it pertains to a code cleanup in the Linux kernel.
How do I fix CVE-2026-43438?
To fix CVE-2026-43438, update the Linux kernel to the latest version where the vulnerability has been addressed.
What is the impact of CVE-2026-43438 on system performance?
CVE-2026-43438 is unlikely to impact system performance as it involves the removal of redundant code.
Is CVE-2026-43438 exploitable?
CVE-2026-43438 is not considered exploitable in the traditional sense, as it does not provide a pathway for unauthorized access or privilege escalation.
What systems are affected by CVE-2026-43438?
CVE-2026-43438 affects the Linux kernel, thus impacting all systems running a vulnerable version of this kernel.