CVE-2026-72080

A flaw was found in the Linux kernel's resctrl filesystem. During the unmount process, a timing issue can occur where a concurrent reader of an event file attempts to access memory that has already been released. This 'use-after-free' vulnerability allows a local attacker to dereference invalid memory. The most significant consequence is system instability, potentially leading to a denial of service (DoS) where the system becomes unresponsive.

A race in resctrl unmount or failure teardown can leave a concurrent reader of a default resource group monitoring file with a stale mon_data private pointer. The reader can drop kernfs active protection and block on rdtgroup_mutex while teardown frees the monitoring private data and destroys the kernfs node. When the reader resumes, RDT_DELETED was not set for the static default group, so the code can treat the group as live and dereference freed kernel memory. For the CVSS the PR:L is used in the paranoid score because a local process with access to resctrl monitoring files may participate in the race during teardown, although reliable full control of mount or unmount operations is commonly administrative. The issue is not network reachable. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to use-after-free and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.