Cloudanix VulnDB

CVE-2026-93181

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can make certain Intel-based computers unstable when processors are added or removed, potentially causing crashes during normal operation or monitoring.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in uncore_box ref/unref ordering during CPU online/offline events leaves boxes uninitialized on first CPU per die and performs incorrect teardown on subsequent hotplug operations, resulting in refcount underflow and premature box destruction in the perf/x86/intel/uncore subsystem.

Why it matters to the business

Systems using Intel CPUs with one-CPU-per-die configurations or frequent CPU hotplug may experience kernel instability, crashes, or corrupted performance monitoring data, reducing reliability for workloads that rely on perf events or dynamic CPU management.

How an attack unfolds

An attacker with local access repeatedly triggers CPU online and offline events to hit the incorrect call ordering in uncore_event_cpu_online and uncore_event_cpu_offline, causing the uncore box to be torn down while still referenced and leading to use-after-free or denial-of-service conditions in the perf subsystem.

How to fix it

Apply the upstream kernel patch that swaps the call order of uncore_box_ref/unref with uncore_change_context and moves allocate_boxes outside uncore_box_ref; rebuild and reboot with the fixed kernel version.

How to confirm the fix worked

Confirm the fix by inspecting the source for the reordered calls in uncore_event_cpu_online and uncore_event_cpu_offline, and test by exercising CPU hotplug while monitoring uncore box initialization and refcount values.

Typical attack path

  1. Obtain local unprivileged access on an affected Linux system
  2. Use CPU hotplug interfaces or tools to force repeated online/offline cycles on CPUs belonging to the same die
  3. Trigger perf event collection to exercise the uncore box paths
  4. Induce kernel oops or panic via the resulting refcount and initialization errors

How to detect it

Search kernel logs for messages related to uncore_box initialization failures, refcount mismatches, or premature teardown during CPU online/offline events; correlate with perf subsystem activity.

What your security team should do

  • Prioritize kernel updates on systems with Intel uncore perf usage and dynamic CPU configurations
  • Restrict unprivileged perf_event_paranoid access until patched
  • Monitor kernel logs for uncore-related oops during CPU hotplug events
  • Validate patch deployment across fleets before the next scheduled maintenance window

The record

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering In uncore_event_cpu_online(), uncore_box_ref() was called before uncore_change_context(). uncore_box_ref() gates on box->cpu >= 0, but box->cpu is still -1 at that point because uncore_change_context() has not run yet. As a result, the box is never initialized on the first CPU to come online in a die, leaving it permanently uninitialized in the single-CPU-per-die case. Thus, box->refcnt is one count below the true value, and in the CPU offline path, the box will be torn down on the second-to-last CPU. In uncore_event_cpu_offline(), uncore_box_unref() was called after uncore_change_context(), so box->cpu is already -1 when the collector CPU goes offline, which prevents it from tearing down the box. Fix by swapping the call order in both paths so that uncore_box_{ref,unref}() runs at the point where box->cpu reflects the correct context. Move allocate_boxes() out of uncore_box_ref() to enable this reordering.

Affected packages

Ecosystem Package Introduced Fixed