GHSA-X642-FQM9-QJ5Q
Vulnerability from github – Published: 2026-09-17 18:32 – Updated: 2026-09-17 18:32In the Linux kernel, the following vulnerability has been resolved:
fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()
A struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that need the structure to remain valid across a sleep (while waiting on acquiring rdtgroup_mutex) take a reference with rdtgroup_kn_get() and release it with rdtgroup_kn_put().
The release path is intended to serve as the fallback freer: if the count drops to zero and the group has already been marked RDT_DELETED, rdtgroup_kn_put() frees the structure.
The bulk teardown paths free_all_child_rdtgrp() and rmdir_all_sub() resulting from a resctrl directory remove or resctrl fs unmount act as the primary freer: they hold rdtgroup_mutex and free each rdtgroup whose waitcount is zero, otherwise they set RDT_DELETED and leave the freeing to the last waiter.
These two freers race. rdtgroup_kn_put() commits waitcount == 0 with atomic_dec_and_test() outside rdtgroup_mutex, then reads rdtgroup::flags. Between those two operations a concurrent caller of free_all_child_rdtgrp() or rmdir_all_sub() (which holds the mutex) can observe waitcount == 0 via atomic_read(), call rdtgroup_remove(), and kfree() the structure.
The subsequent read of rdtgroup::flags in rdtgroup_kn_put() is then a use-after-free, and the structure may even be freed twice if the freed memory happens to satisfy the RDT_DELETED flag check.
Replace the bare atomic_dec_and_test() with atomic_dec_and_mutex_lock() so that the decrement-to-zero takes rdtgroup_mutex before the count becomes globally visible. The inspection of rdtgroup::flags then runs under the same mutex held by the bulk freers, making the two paths mutually exclusive.
The common case where the count does not reach zero remains lock-free. Defer kernfs_unbreak_active_protection() until after the mutex is dropped since kernfs active protections functionally wrap rdtgroup_mutex. Remove resource group, which in turn drops its kernfs reference, after kernfs protection is restored.
[ bp: Split the commit messsages into smaller, easier-parseable paragraphs. ]
{
"affected": [],
"aliases": [
"CVE-2026-93100"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:18:04Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/resctrl: Prevent use-after-free in rdtgroup_kn_put()\n\nA struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that\nneed the structure to remain valid across a sleep (while waiting on acquiring\nrdtgroup_mutex) take a reference with rdtgroup_kn_get() and release it with\nrdtgroup_kn_put().\n\nThe release path is intended to serve as the fallback freer: if the count\ndrops to zero and the group has already been marked RDT_DELETED,\nrdtgroup_kn_put() frees the structure.\n\nThe bulk teardown paths free_all_child_rdtgrp() and rmdir_all_sub() resulting\nfrom a resctrl directory remove or resctrl fs unmount act as the primary\nfreer: they hold rdtgroup_mutex and free each rdtgroup whose waitcount is\nzero, otherwise they set RDT_DELETED and leave the freeing to the last waiter.\n\nThese two freers race. rdtgroup_kn_put() commits waitcount == 0 with\natomic_dec_and_test() outside rdtgroup_mutex, then reads rdtgroup::flags.\nBetween those two operations a concurrent caller of free_all_child_rdtgrp()\nor rmdir_all_sub() (which holds the mutex) can observe waitcount == 0 via\natomic_read(), call rdtgroup_remove(), and kfree() the structure.\n\nThe subsequent read of rdtgroup::flags in rdtgroup_kn_put() is then\na use-after-free, and the structure may even be freed twice if the freed\nmemory happens to satisfy the RDT_DELETED flag check.\n\nReplace the bare atomic_dec_and_test() with atomic_dec_and_mutex_lock() so\nthat the decrement-to-zero takes rdtgroup_mutex before the count becomes\nglobally visible. The inspection of rdtgroup::flags then runs under the same\nmutex held by the bulk freers, making the two paths mutually exclusive.\n\nThe common case where the count does not reach zero remains lock-free. Defer\nkernfs_unbreak_active_protection() until after the mutex is dropped since\nkernfs active protections functionally wrap rdtgroup_mutex. Remove resource\ngroup, which in turn drops its kernfs reference, after kernfs protection is\nrestored.\n\n [ bp: Split the commit messsages into smaller, easier-parseable paragraphs. ]",
"id": "GHSA-x642-fqm9-qj5q",
"modified": "2026-09-17T18:32:10Z",
"published": "2026-09-17T18:32:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93100"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4c593c62c1499665baebbb41b70e2c9b7e947b86"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ae69f936e8ffed553d899ba4c02f8a7461a89e54"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f5bcf539484d2d604c2f2330e09487ea090b21c7"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.