CVE-2026-93100

A flaw was found in the Linux kernel's resctrl filesystem. A race condition exists in the rdtgroup_kn_put() function during the handling of rdtgroup structure reference counts. This allows a local attacker to trigger a use-after-free vulnerability, where memory is accessed after it has been deallocated. This can lead to memory corruption, potentially causing system instability or a denial of service.

A race in fs resctrl can cause a use after free in rdtgroup_kn_put() when rdtgroup::waitcount is decremented to zero outside rdtgroup_mutex and a concurrent teardown path frees the same rdtgroup before rdtgroup flags are inspected. The same race can also create a double free condition if the freed memory later satisfies the RDT_DELETED flag check. For the CVSS the PR:L is used for the paranoid score because practical triggering may be possible by a local user or delegated service account that can operate on resctrl groups, even if default deployments often restrict resctrl administration to root. The issue is not network reachable and requires local interaction with the resctrl filesystem or teardown paths. Impact is at least local denial of service via kernel crash. In the worst case it may allow confidentiality or integrity impact because use after free and double free are memory corruption primitives that can sometimes be developed into privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.