CVE-2026-93100

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the fs/resctrl component. The problem occurs due to a race condition between the fallback freer in the rdtgroup kn put() function and the primary bulk teardown paths free all child rdtgrp() and rmdir all sub(). Specifically, rdtgroup kn put() uses atomic dec and test() outside the rdtgroup mutex to check the waitcount variable. A concurrent caller of the bulk teardown paths can observe the waitcount as zero, call rdtgroup remove(), and free the structure via kfree(). This leads to a use-after-free when rdtgroup kn put() subsequently reads the flags variable, and may result in a double-free if the memory satisfies the RDT DELETED flag check.

Recommendations As a temporary mitigation, restrict access to the fs/resctrl filesystem to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.