CVE-2026-93099: fs/resctrl: Fix UAF from worker threads when domains are removed

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.

   Fixed in 7.0.0-42.42~24.04.1
2. Upgrade

   Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.

   Fixed in 7.0.0-42.42.1~24.04.1
3. Upgrade

   Upgrade ubuntu/linux to a version that resolves this vulnerability.

   Fixed in 7.0.0-42.42
4. Upgrade

   Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

   Fixed in 7.0.0-1016.17
5. Upgrade

   Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

   Fixed in 7.0.0-1016.18
6. Upgrade

   Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

   Fixed in 7.0.0-1017.17
7. Upgrade

   Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.

   Fixed in 7.0.0-1017.17
8. Upgrade

   Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

   Fixed in 7.0.0-1015.16
9. Upgrade

   Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

   Fixed in 7.0.0-42.42.1
10. Compensating control

    In the resctrl worker implementation, remove cpus_read_lock() acquisition and synchronously drain pending and in-flight work before the architecture frees an rdt_l3_mon_domain.

11. Compensating control

    During CPU offline, release rdtgroup_mutex around cancel_delayed_work_sync() so a worker waiting on the mutex can complete before its work is re-pinned to a different CPU, and ensure resctrl cancels workers regardless of the order in which MBA control and corresponding L3 monitor domains are offlined.

Event History