KernelScan.io

HIGH

sched_ext CgroupInit UAF

CVE-2026-43438

CVSS 7.8 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

KernelScan AI6.7MEDIUM

01

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Remove redundant css_put() in scx_cgroup_init() The iterator css_for_each_descendant_pre() walks the cgroup hierarchy under cgroup_lock(). It does not increment the reference counts on yielded css structs. According to the cgroup documentation, css_put() should only be used to release a reference obtained via css_get() or css_tryget_online(). Since the iterator does not use either of these to acquire a reference, calling css_put() in the error path of scx_cgroup_init() causes a refcount underflow. Remove the unbalanced css_put() to prevent a potential Use-After-Free (UAF) vulnerability.

02

Engine v0.2.0

Risk summary

A reference counting error in sched_ext cgroup initialization can cause use-after-free conditions when scheduler loading fails. This affects systems where root users load custom BPF schedulers with cgroup support, potentially leading to kernel memory corruption or crashes.

Affectedkernel/sched/ext.c (sched_ext scheduler)

Vulnerability analysis

The vulnerability occurs in scx_cgroup_init() where css_for_each_descendant_pre() iterator walks cgroup hierarchy without incrementing reference counts, but the error path incorrectly calls css_put() causing reference underflow. This can free CSS structs prematurely, creating use-after-free conditions. The fix removes the unbalanced css_put() call. Attack surface is limited to privileged users who can load sched_ext BPF schedulers, typically requiring CAP_SYS_ADMIN.

03

BranchFixed inPatch commit
6.126.12.78cc095cd305fd
6.186.18.196eaaa67d6998
6.196.19.9bf50f3285eda
mainline7.01336b579f607