CVE-2026-93099

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/resctrl: Fix UAF from worker threads when domains are removed

The mbm_handle_overflow() and cqm_handle_limbo() workers read event counters

and may sleep while doing so. They are scheduled via delayed_work embedded in

struct rdt_l3_mon_domain. Architecture allocates and frees these domains from

CPU hotplug callbacks under cpus_write_lock(), and the workers acquire

cpus_read_lock() to keep the domain alive across their access.

A use-after-free can occur when a worker is blocked waiting for

cpus_read_lock() while the hotplug core holds cpus_write_lock(): the

architecture frees the rdt_l3_mon_domain that contains the worker's

work_struct. When the worker unblocks, the container_of() it performs on the

embedded work pointer dereferences freed memory.

Drop cpus_read_lock() from the workers and instead drain pending and in-flight

work synchronously before the architecture can free the domain. Since

architecture offlin

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References