{"cve":"CVE-2026-93100","nvd":{"published":"2026-09-17T17:18:04.223","modified":"2026-10-21T13:20:59.453","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/resctrl: Prevent use-after-free in rdtgroup_kn_put()\n\nA struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that\nneed the structure to remain valid across a sleep (while waiting on acquiring\nrdtgroup_mutex) take a reference with rdtgroup_kn_get() and release it with\nrdtgroup_kn_put().\n\nThe release path is intended to serve as the fallback freer: if the count\ndrops to zero and the group has already been marked RDT_DELETED,\nrdtgroup_kn_put() frees the structure.\n\nThe bulk teardown paths free_all_child_rdtgrp() and rmdir_all_sub() resulting\nfrom a resctrl directory remove or resctrl fs unmount act as the primary\nfreer: they hold rdtgroup_mutex and free each rdtgroup whose waitcount is\nzero, otherwise they set RDT_DELETED and leave the freeing to the last waiter.\n\nThese two freers race. rdtgroup_kn_put() commits waitcount == 0 with\natomic_dec_and_test() outside rdtgroup_mutex, then reads rdtgroup::flags.\nBetween those two operations a concurrent caller of free_all_child_rdtgrp()\nor rmdir_all_sub() (which holds the mutex) can observe waitcount == 0 via\natomic_read(), call rdtgroup_remove(), and kfree() the structure.\n\nThe subsequent read of rdtgroup::flags in rdtgroup_kn_put() is then\na use-after-free, and the structure may even be freed twice if the freed\nmemory happens to satisfy the RDT_DELETED flag check.\n\nReplace the bare atomic_dec_and_test() with atomic_dec_and_mutex_lock() so\nthat the decrement-to-zero takes rdtgroup_mutex before the count becomes\nglobally visible. The inspection of rdtgroup::flags then runs under the same\nmutex held by the bulk freers, making the two paths mutually exclusive.\n\nThe common case where the count does not reach zero remains lock-free. Defer\nkernfs_unbreak_active_protection() until after the mutex is dropped since\nkernfs active protections functionally wrap rdtgroup_mutex. Remove resource\ngroup, which in turn drops its kernfs reference, after kernfs protection is\nrestored.\n\n  [ bp: Split the commit messsages into smaller, easier-parseable paragraphs. ]","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/4c593c62c1499665baebbb41b70e2c9b7e947b86","https://git.kernel.org/stable/c/828ff461c136b95d13b8d712c0a7a06a640e313a","https://git.kernel.org/stable/c/971b40e3ca1279ca4917889e0195d33b66d071a4","https://git.kernel.org/stable/c/ae69f936e8ffed553d899ba4c02f8a7461a89e54","https://git.kernel.org/stable/c/f5bcf539484d2d604c2f2330e09487ea090b21c7"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-93100","score":0.00209,"percentile":0.10943,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}