UBUNTU-CVE-2026-72080: Use After Free
In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix use-after-free during unmount During unmount or failure teardown all mondata structures that contain monitoring event file private data are freed after which kernfs nodes are removed. However, the RDTDELETED flag is never set for the statically allocated default resource group. A concurrent reader of an event file associated with the default resource group may, after dropping kernfs active protection, block on rdtgroupmutex while unmount proceeds to free the file private data and destroy the kernfs node without waiting for the reader. When the mutex is released, the reader wakes up, observes that RDTDELETED is not set for the default group, and dereferences the already-freed file private data. The scenario can be depicted as follows: CPU0 CPU1 / Default resource group's monitoring data accessible via kernfs file with kernfsnode::priv pointing to a struct mondata. User opens the file for reading. / rdtgroupmondatashow() / arch encounters fatal error / rdtgroupknlocklive() resctrlexit() atomicinc(&rdtgroupdefault.waitcount) cpusreadlock() kernfsbreakactiveprotection(kn) mutexlock(&rdtgroupmutex) cpusreadlock() resctrlfsteardown() mutexlock(&rdtgroupmutex) rmdirallsub() monputknpriv() / Delete all mondata structures / rdtgroupdestroyroot() kernfsdestroyroot() rdtgroupdefault.kn = NULL mutexunlock(&rdtgroupmutex) / rdtgroupdefault.flags is empty so rdtgroupknlocklive() returns &rdtgroupdefault / md = of->kn->priv; / md points to freed mondata / Set RDTDELETED for the default group unconditionally since the flag does not lead to the freeing of this statically allocated group. Do not allow a new resctrl mount if there are any waiters on default group of previous mount. A new mount will re-initialize the default group that would appear to waiters from previous mount as though the default group is accessible causing them to access the mondata structures from the previous mount that have been removed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Configuration
Set RDT_DELETED for the default resource group unconditionally so waiters cannot access freed monitoring data after unmount.
Linux kernel fs/resctrl RDT_DELETED flag on the statically allocated default resource group = set unconditionally - Configuration
Do not allow a new resctrl mount if any waiters remain on the default group from a previous mount.
Linux kernel fs/resctrl new resctrl mount when the previous mount's default group has waiters = deny
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using an affected Ubuntu Linux kernel with resctrl monitoring event files accessible are exposed. Exploitation requires a concurrent reader of an event file associated with the default resource group while resctrl is being unmounted or torn down.
What level of access does an attacker need?
The supplied vector indicates local access, low attack complexity, low privileges, and no user interaction. The described race requires the attacker to open and read the relevant resctrl monitoring event file concurrently with teardown.
What is the potential impact?
The use-after-free can result in high confidentiality, integrity, and availability impact according to the supplied severity vector. A reader can dereference freed monitoring-data private storage after teardown removes the associated kernfs node.