CVE-2026-93099

A flaw was found in the Linux kernel's fs/resctrl component. This use-after-free (UAF) vulnerability occurs when worker threads attempt to access memory that has already been released during CPU hotplug operations. A local attacker could potentially exploit this flaw to cause a system crash, leading to a denial of service, or possibly achieve privilege escalation by executing arbitrary code.

A race in resctrl CPU hotplug handling can leave mbm_handle_overflow or cqm_handle_limbo workers running after the rdt_l3_mon_domain containing their delayed_work has been removed. If a worker is blocked before it can protect the domain lifetime, the hotplug path may free the domain and the later container_of() on the embedded work pointer can dereference freed kernel memory. For the CVSS the PR:L is used for the paranoid score because triggering may be possible from a local actor with delegated CPU hotplug or resctrl control, reduced root capabilities, or a service account that can offline CPUs or manage resctrl state. The issue is not network reachable and requires local control plane actions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.