Linux Kernel EUVD-2026-28744

The vulnerability exists in the sched_ext (scheduler extensions) subsystem of the Linux kernel, specifically in the scx_cgroup_init() function's error handling path. The code improperly calls css_put() on cgroup subsystem state (css) structures obtained from css_for_each_descendant_pre() iterator. According to kernel cgroup API contracts, this iterator walks the cgroup hierarchy under cgroup_lock() without incrementing reference counts on yielded css structs. The css_put() function should only release references explicitly acquired via css_get() or css_tryget_online(). Calling css_put() without a corresponding reference acquisition causes a reference count underflow, corrupting kernel memory management state and creating a Use-After-Free condition. This affects the CPU scheduler's cgroup integration layer, a foundational component for container resource management. The affected CPE strings (cpe:2.3:a:linux:linux) with version-specific Git commit hashes indicate patches applied to multiple stable kernel branches (6.12.x, 6.18.x, 6.19.x, 7.0).