Executive brief
The Linux kernel's Resource Control (resctrl) subsystem contains a use-after-free vulnerability in worker threads that manage overflow and limbo counter events. When CPUs are offlined and resource domains are freed, worker threads may attempt to access freed memory, potentially causing kernel crashes or instability. This affects systems using resctrl for performance monitoring and resource allocation on multi-CPU configurations.
Technical details
A use-after-free vulnerability exists in the mbm_handle_overflow() and cqm_handle_limbo() worker threads in fs/resctrl. The workers acquire cpus_read_lock() to protect access to rdt_l3_mon_domain structures, but a race condition can occur when CPU hotplug callbacks hold cpus_write_lock() and free domains while workers are blocked waiting for cpus_read_lock(). The fix removes the cpus_read_lock() dependency and instead synchronously drains pending work before domain deallocation under cpus_write_lock(), with temporary mutex release during cancel_delayed_work_sync() to allow blocked workers to complete. Attack vector is local (CPU hotplug operations), no authentication or network access required. An attacker with local system access could trigger CPU hotplug events to cause denial of service through kernel panics.
Affected products
- Linux Linux kernel affected versions unspecified
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fix included in the vulnerability advisory