CVE-2026-43438

kernel: sched_ext: Remove redundant css_put() in scx_cgroup_init()

Loading…

Severity

Moderate

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · May 8, 2026

Updated · October 20, 2026

Description

A flaw was found in the Linux kernel's sched_ext component. This vulnerability is caused by a redundant css_put() call in the scx_cgroup_init() function, leading to a reference count underflow. This can result in a Use-After-Free (UAF) vulnerability, potentially allowing a local attacker to cause a denial of service or achieve privilege escalation.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-1341 · Multiple Releases of Same Resource or Handle