CVE-2026-93099

In the Linux kernel, the following vulnerability has been resolved:

fs/resctrl: Fix UAF from worker threads when domains are removed

The mbm_handle_overflow() and cqm_handle_limbo() workers read event counters

and may sleep while doing so. They are scheduled via delayed_work embedded in

struct rdt_l3_mon_domain. Architecture allocates and frees these domains from

CPU hotplug callbacks under cpus_write_lock(), and the workers acquire

cpus_read_lock() to keep the domain alive across their access.

A use-after-free can occur when a worker is blocked waiting for

cpus_read_lock() while the hotplug core holds cpus_write_lock(): the

architecture frees the rdt_l3_mon_domain that contains the worker's

work_struct. When the worker unblocks, the container_of() it performs on the

embedded work pointer dereferences freed memory.

Drop cpus_read_lock() from the workers and instead drain pending and in-flight

work synchronously before the architecture can free the domain. Since

architecture offlines the domain under cpus_write_lock() after it has been

unlinked from the RCU list and a grace period has elapsed, no new work can be

scheduled. The cancel only needs to wait out existing work. Drop

rdtgroup_mutex during CPU offline around cancel_delayed_work_sync() so that

a worker waiting on the mutex can complete before re-pinning the work on

a different CPU.

When offlining a CPU the architecture may iterate over resources in any order.

For example, the MBA control domain may be offlined before or after

a corresponding L3 monitor domain. Ensure that resctrl fs cancels the workers

no matter what order the architecture offlines the domains.