Cloudanix VulnDB

CVE-2026-43438

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

May 8, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding error in the Linux kernel could let someone already on the system crash it or gain extra access by mishandling internal tracking of scheduling features.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Unbalanced css_put() call in scx_cgroup_init() error path under cgroup_lock() triggers refcount underflow on css structs obtained via css_for_each_descendant_pre(), enabling use-after-free in the Linux kernel scheduler.

Why it matters to the business

Local attackers can crash Linux systems or escalate privileges, risking downtime and data exposure on servers and endpoints running affected kernels; low public exploit activity reduces immediate urgency but kernel-wide impact affects many distributions.

How an attack unfolds

An attacker with local access crafts input to trigger the error path during sched_ext cgroup initialization, causing the underflow that leads to a dangling reference and subsequent use-after-free for code execution or denial of service.

How to fix it

Apply the upstream patch removing the redundant css_put() or upgrade to a Linux kernel version that includes the resolution for this sched_ext issue; disable sched_ext if not required until patched kernels are deployed.

How to confirm the fix worked

Confirm the css_put() call has been removed from the error path in scx_cgroup_init(); test cgroup hierarchy operations under sched_ext to ensure no refcount underflow occurs on error conditions.

Typical attack path

  1. Obtain local user access on a Linux system
  2. Load or interact with sched_ext-enabled workloads that exercise scx_cgroup_init()
  3. Trigger the error path to induce refcount underflow
  4. Reuse the freed css object to achieve UAF for privilege escalation or crash

How to detect it

Review kernel logs and audit records for crashes or warnings related to sched_ext cgroup initialization; look for unexpected refcount or UAF-related oops/panic messages in dmesg or system logs.

What your security team should do

  • Prioritize kernel updates for systems using sched_ext or cgroups
  • Audit workloads for sched_ext usage and restrict where possible
  • Monitor for future kernel releases addressing this UAF
  • Apply least-privilege local access controls as a compensating measure

The record

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Remove redundant css_put() in scx_cgroup_init() The iterator css_for_each_descendant_pre() walks the cgroup hierarchy under cgroup_lock(). It does not increment the reference counts on yielded css structs. According to the cgroup documentation, css_put() should only be used to release a reference obtained via css_get() or css_tryget_online(). Since the iterator does not use either of these to acquire a reference, calling css_put() in the error path of scx_cgroup_init() causes a refcount underflow. Remove the unbalanced css_put() to prevent a potential Use-After-Free (UAF) vulnerability.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities