CVE-2026-93100

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()

A struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that

need the structure to remain valid across a sleep (while waiting on acquiring

rdtgroup_mutex) take a reference with rdtgroup_kn_get() and release it with

rdtgroup_kn_put().

The release path is intended to serve as the fallback freer: if the count

drops to zero and the group has already been marked RDT_DELETED,

rdtgroup_kn_put() frees the structure.

The bulk teardown paths free_all_child_rdtgrp() and rmdir_all_sub() resulting

from a resctrl directory remove or resctrl fs unmount act as the primary

freer: they hold rdtgroup_mutex and free each rdtgroup whose waitcount is

zero, otherwise they set RDT_DELETED and leave the freeing to the last waiter.

These two freers race. rdtgroup_kn_put() commits waitcount == 0 with

atomic_dec_and_test() outside rdtgroup_mutex, then reads rdtgroup::fla

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References