PT-2026-39099 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-21 · CVE-2026-43438

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A refcount underflow occurs in the scx cgroup init() function due to a redundant call to css put() in the error path. The iterator css for each descendant pre() traverses the cgroup hierarchy under cgroup lock() without incrementing reference counts on yielded css structs. Because css put() is intended only to release references obtained via css get() or css tryget online(), its incorrect use in this context can lead to a Use-After-Free (UAF) condition, where the system attempts to access memory that has already been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-43438

Affected Products

Linux Kernel

References · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43438 · Vendor Advisory
• https://git.kernel.org/stable/c/cc095cd305fddbe25a968e4a78436ff9476cf0f6 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43438 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43438 · Security Note
• https://ubuntu.com/security/CVE-2026-43438 · Vendor Advisory
• https://git.kernel.org/stable/c/6eaaa67d6998f6c30c462b140db8c062e07ec473 · Patch
• https://git.kernel.org/stable/c/bf50f3285eda8a0173625fcdb5f183f96e1008cd · Patch
• https://cve.org/CVERecord?id=CVE-2026-43438 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43438 · Vendor Advisory
• https://git.kernel.org/stable/c/1336b579f6079fb8520be03624fcd9ba443c930b · Patch
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post
• https://t.me/cveNotify/164418 · Telegram Post
• https://twitter.com/vuldb/status/2052790916390506868 · Twitter Post
• https://git.kernel.org/linus/1336b579f6079fb8520be03624fcd9ba443c930b · Note
• https://twitter.com/CVEnew/status/2052767631573389439 · Twitter Post