The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sched_ext: Remove redundant css_put() in scx_cgroup_init() The iterator css_for_each_descendant_pre()     walks the cgroup hierarchy under cgroup_lock(). It does not increment the reference counts on yielded css     structs. According to the cgroup documentation, css_put() should only be used to release a reference     obtained via css_get() or css_tryget_online(). Since the iterator does not use either of these to acquire     a reference, calling css_put() in the error path of scx_cgroup_init() causes a refcount underflow. Remove     the unbalanced css_put() to prevent a potential Use-After-Free (UAF) vulnerability. (CVE-2026-43438)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-43438

high Nessus Plugin ID 314401

Version 1.4

Version 1.3

Version 1.1

Version 1.4 May 29, 2026, 5:27 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605291727
Version 1.3 May 25, 2026, 10:30 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605252230
Version 1.1 May 14, 2026, 3:47 AM New Plugin Feed: 202605140347