CVE-2026-93099
Description
A flaw was found in the Linux kernel's fs/resctrl component. This use-after-free (UAF) vulnerability occurs when worker threads attempt to access memory that has already been released during CPU hotplug operations. A local attacker could potentially exploit this flaw to cause a system crash, leading to a denial of service, or possibly achieve privilege escalation by executing arbitrary code.
Statement
A race in resctrl CPU hotplug handling can leave mbm_handle_overflow or cqm_handle_limbo workers running after the rdt_l3_mon_domain containing their delayed_work has been removed. If a worker is blocked before it can protect the domain lifetime, the hotplug path may free the domain and the later container_of() on the embedded work pointer can dereference freed kernel memory. For the CVSS the PR:L is used for the paranoid score because triggering may be possible from a local actor with delegated CPU hotplug or resctrl control, reduced root capabilities, or a service account that can offline CPUs or manage resctrl state. The issue is not network reachable and requires local control plane actions.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
