CVE-2026-93100 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()
A struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that need the structure to remain valid across a sleep (while waiting on acquiring rdtgroup_mutex) take a reference with rdtgroup_kn_get() and release it with rdtgroup_kn_put().
The release path is intended to serve as the fallback freer: if the count drops to zero and the group has already been marked RDT_DELETED, rdtgroup_kn_put() frees the structure.
The bulk teardown paths free_all_child_rdtgrp() and rmdir_all_sub() resulting from a resctrl directory remove or resctrl fs unmount act as the primary freer: they hold rdtgroup_mutex and free each rdtgroup whose waitcount is zero, otherwise they set RDT_DELETED and leave the freeing to the last waiter.
These two freers race. rdtgroup_kn_put() commits waitcount == 0 with atomic_dec_and_test() outside rdtgroup_mutex, then reads rdtgroup::flags. Between those two operations a concurrent caller of free_all_child_rdtgrp() or rmdir_all_sub() (which holds the mutex) can observe waitcount == 0 via atomic_read(), call rdtgroup_remove(), and kfree() the structure.
The subsequent read of rdtgroup::flags in rdtgroup_kn_put() is then a use-after-free, and the structure may even be freed twice if the freed memory happens to satisfy the RDT_DELETED flag check.
Replace the bare atomic_dec_and_test() with atomic_dec_and_mutex_lock() so that the decrement-to-zero takes rdtgroup_mutex before the count becomes globally visible. The inspection of rdtgroup::flags then runs under the same mutex held by the bulk freers, making the two paths mutually exclusive.
The common case where the count does not reach zero remains lock-free. Defer kernfs_unbreak_active_protection() until after the mutex is dropped since kernfs active protections functionally wrap rdtgroup_mutex. Remove resource group, which in turn drops its kernfs reference, after kernfs protection is restored.
[ bp: Split the commit messsages into smaller, easier-parseable paragraphs. ]
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's Resource Control (resctrl) subsystem manages CPU and memory bandwidth allocation through a hierarchical structure of resource groups. A critical concurrency flaw was identified in the reference counting mechanism for these structures, specifically within the rdtgroup_kn_put() function. The system relies on an atomic waitcount to track active references to each struct rdtgroup object. When code paths need to hold onto this structure across sleep states while waiting to acquire a mutex, they increment this count using rdtgroup_kn_get(). Conversely, when such operations complete or fail, the reference is released via rdtgroup_kn_put(), which serves as the fallback deallocation path if the reference count drops to zero and the group has been marked for deletion.
The vulnerability arises from a race condition between two distinct cleanup mechanisms: the individual release path in rdtgroup_kn_put() and the bulk teardown paths triggered by directory removal or filesystem unmounting, specifically free_all_child_rdtgrp() and rmdir_all_sub(). The latter functions operate while holding the rdtgroup_mutex. They check if a group's waitcount is zero; if so, they immediately free the structure. If not, they mark it with RDT_DELETED to defer freeing until all waiters have released their references. However, in rdtgroup_kn_put(), the code performs an atomic decrement and test operation outside the protection of the mutex. This creates a window where another thread holding the mutex can observe that the count has reached zero, proceed to remove and free the structure via kernfs operations, and return before the first thread completes its subsequent read of the flags field.
This sequence results in a use-after-free vulnerability because rdtgroup_kn_put() reads the rdtgroup::flags after potentially having been preempted while another thread freed the memory. If the freed memory is reallocated for another purpose that happens to satisfy the RDT_DELETED flag check, or if the kernel attempts to access fields of the already-freed object, undefined behavior occurs. This can lead to system crashes, data corruption, or potential privilege escalation depending on how the attacker manipulates the heap state and timing conditions. The issue is classified under CWE-416: Use After Free, which describes errors where a program continues to use a pointer after it has been freed, leading to unpredictable behavior.
The operational impact of this vulnerability includes kernel panics due to invalid memory accesses during system shutdown or resource group removal operations. In more severe scenarios involving crafted user-space interactions with the resctrl filesystem interface, an attacker could exploit the race condition to execute arbitrary code within the kernel context by controlling the contents of the freed memory slab before it is accessed again. This represents a significant security risk as it allows for local privilege escalation from unprivileged users who have access to create and remove resource groups in the resctrl hierarchy.
To mitigate this issue, the Linux kernel developers replaced the bare atomic_dec_and_test() call with atomic_dec_and_mutex_lock(). This modification ensures that if the reference count drops to zero, the thread must acquire the rdtgroup_mutex before the decrement is globally visible or processed further. By holding the mutex during both the check and subsequent flag inspection, the code guarantees mutual exclusion with the bulk teardown paths that also hold this same lock. Consequently, only one path can free the structure at any given time, eliminating the race condition entirely while maintaining performance for the common case where the count does not reach zero, as those operations remain largely lock-free until necessary synchronization points are reached.
Additional adjustments were made to ensure proper interaction with kernfs active protections. The function kernfs_unbreak_active_protection() is now deferred until after the mutex is dropped, ensuring that reference counting and locking semantics align correctly with the kernel's filesystem layer expectations. Furthermore, resource group removal logic was adjusted to drop its kernfs reference only after kernfs protection has been restored, preventing premature invalidation of references during complex teardown sequences. These changes are aligned with ATT&CK technique T1059: Command and Scripting Interpreter in contexts where attackers might leverage system administration tools or scripts to trigger the vulnerable code paths through automated resctrl manipulation. The fix restores memory safety guarantees within the kernel's resource control subsystem, preventing exploitation of this concurrency flaw.