Potential Use-After-Free Vulnerability in Linux Kernel Affecting System Performance

CVE-2026-43438

What is CVE-2026-43438?

A vulnerability in the Linux kernel arises from an issue within the cgroup subsystem. When the iterator css_for_each_descendant_pre() is employed, it operates under cgroup_lock() without incrementing the reference counts on the yielded css structures. The improper use of css_put() in the error path of scx_cgroup_init() can lead to a situation where reference counts become unbalanced, resulting in a potential Use-After-Free scenario. This could allow an attacker to exploit the vulnerability, compromising system stability and security.

References