Cloudanix VulnDB

CVE-2026-93100

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw inside the Linux kernel's resource control feature can let memory be used after it is freed, which may crash servers or let attackers gain extra privileges.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race between atomic_dec_and_test outside mutex and concurrent bulk free under mutex in resctrl rdtgroup_kn_put leads to use-after-free when reading flags after kfree.

Why it matters to the business

Linux systems using resctrl may experience kernel crashes, memory corruption, or local privilege escalation, disrupting workloads and requiring emergency patching.

How an attack unfolds

An attacker with resctrl filesystem access triggers concurrent directory removal or unmount while another operation sleeps on rdtgroup_mutex; the bulk freer observes zero waitcount and frees the structure, allowing the release path to read freed memory.

How to fix it

Apply upstream fix replacing atomic_dec_and_test with atomic_dec_and_mutex_lock in rdtgroup_kn_put, deferring kernfs_unbreak_active_protection until after mutex drop; rebuild and boot patched kernel.

How to confirm the fix worked

Confirm presence of atomic_dec_and_mutex_lock call in rdtgroup_kn_put source; run stress tests exercising concurrent resctrl teardown and waiter paths to verify no double-free or UAF.

Typical attack path

  1. Mount or access resctrl filesystem
  2. Create and manipulate resource groups to increment waitcount
  3. Trigger concurrent rmdir_all_sub or free_all_child_rdtgrp while sleeping on mutex
  4. Cause atomic_dec_and_test to observe zero after structure has been kfree'd
  5. Read freed flags field to trigger use-after-free

How to detect it

Search kernel logs and dmesg for use-after-free reports mentioning rdtgroup_kn_put, rdtgroup_remove, or free_all_child_rdtgrp; inspect for crashes during resctrl directory removal or filesystem unmount.

What your security team should do

  • Prioritize kernel upgrade on all systems exposing resctrl
  • Restrict unprivileged access to resctrl mount points until patched
  • Enable kernel hardening features such as KASAN and lockdep for detection during testing
  • Monitor for resctrl-related oops and schedule rapid rollout given 37 days since publication

The record

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() A struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that need the structure to remain valid across a sleep (while waiting on acquiring rdtgroup_mutex) take a reference with rdtgroup_kn_get() and release it with rdtgroup_kn_put(). The release path is intended to serve as the fallback freer: if the count drops to zero and the group has already been marked RDT_DELETED, rdtgroup_kn_put() frees the structure. The bulk teardown paths free_all_child_rdtgrp() and rmdir_all_sub() resulting from a resctrl directory remove or resctrl fs unmount act as the primary freer: they hold rdtgroup_mutex and free each rdtgroup whose waitcount is zero, otherwise they set RDT_DELETED and leave the freeing to the last waiter. These two freers race. rdtgroup_kn_put() commits waitcount == 0 with atomic_dec_and_test() outside rdtgroup_mutex, then reads rdtgroup::flags. Between those two operations a concurrent caller of free_all_child_rdtgrp() or rmdir_all_sub() (which holds the mutex) can observe waitcount == 0 via atomic_read(), call rdtgroup_remove(), and kfree() the structure. The subsequent read of rdtgroup::flags in rdtgroup_kn_put() is then a use-after-free, and the structure may even be freed twice if the freed memory happens to satisfy the RDT_DELETED flag check. Replace the bare atomic_dec_and_test() with atomic_dec_and_mutex_lock() so that the decrement-to-zero takes rdtgroup_mutex before the count becomes globally visible. The inspection of rdtgroup::flags then runs under the same mutex held by the bulk freers, making the two paths mutually exclusive. The common case where the count does not reach zero remains lock-free. Defer kernfs_unbreak_active_protection() until after the mutex is dropped since kernfs active protections functionally wrap rdtgroup_mutex. Remove resource group, which in turn drops its kernfs reference, after kernfs protection is restored. [ bp: Split the commit messsages into smaller, easier-parseable paragraphs. ]

Affected packages

Ecosystem Package Introduced Fixed