UBUNTU-CVE-2026-93099: Use After Free

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix UAF from worker threads when domains are removed The mbmhandleoverflow() and cqmhandlelimbo() workers read event counters and may sleep while doing so. They are scheduled via delayedwork embedded in struct rdtl3mondomain. Architecture allocates and frees these domains from CPU hotplug callbacks under cpuswritelock(), and the workers acquire cpusreadlock() to keep the domain alive across their access. A use-after-free can occur when a worker is blocked waiting for cpusreadlock() while the hotplug core holds cpuswritelock(): the architecture frees the rdtl3mondomain that contains the worker's workstruct. When the worker unblocks, the containerof() it performs on the embedded work pointer dereferences freed memory. Drop cpusreadlock() from the workers and instead drain pending and in-flight work synchronously before the architecture can free the domain. Since architecture offlines the domain under cpuswritelock() after it has been unlinked from the RCU list and a grace period has elapsed, no new work can be scheduled. The cancel only needs to wait out existing work. Drop rdtgroupmutex during CPU offline around canceldelayedworksync() so that a worker waiting on the mutex can complete before re-pinning the work on a different CPU. When offlining a CPU the architecture may iterate over resources in any order. For example, the MBA control domain may be offlined before or after a corresponding L3 monitor domain. Ensure that resctrl fs cancels the workers no matter what order the architecture offlines the domains.