The Linux kernel scheduler extension contains a redundant css_put() call in the error path of scx_cgroup_init(). Because the iterator css_for_each_descendant_pre() does not acquire references before yielding css structures, the extra css_put() causes a reference‑count underflow. This imbalance can lead to a use‑after‑free condition in kernel memory, enabling an attacker to corrupt or overwrite memory and potentially gain arbitrary code execution or cause a system crash.

All Linux kernel versions that have not yet incorporated the commit that removes the redundant css_put() in scx_cgroup_init() are affected. The fix is present in the kernel source tree referenced by git commit identifiers, so any release based on a kernel snapshot that includes that change is considered safe. No specific version numbers were supplied.

The CVSS severity is not provided in the advisory, but the EPSS score indicates a probability of less than 1%. The vulnerability is not listed in the CISA KEV catalog. Nonetheless, use‑after‑free bugs at the kernel level are generally considered high‑risk because they can allow privileged attackers to execute arbitrary code with kernel privileges. The likely attack vector would involve an attacker with the ability to trigger the error path in scx_cgroup_init(), such as through malformed cgroup operations, but explicit exploitation details are not disclosed here.