Executive brief
The Linux kernel's resource control (resctrl) subsystem contains a use-after-free vulnerability in how it manages memory for resource group structures. When multiple processes attempt to access or delete resource groups simultaneously, a race condition can cause a freed memory region to be accessed or freed twice, potentially leading to system crashes or unpredictable behavior. This affects systems using the resctrl feature for resource management.
Technical details
This is a use-after-free vulnerability (CWE-416) in fs/resctrl's rdtgroup_kn_put() function. The vulnerable component uses reference counting (waitcount) to manage struct rdtgroup lifecycle. The root cause is a race condition between two freeing paths: rdtgroup_kn_put() (which decrements the reference count atomically) and bulk teardown paths (free_all_child_rdtgrp() and rmdir_all_sub()). Between the atomic decrement and the subsequent flag check, the bulk teardown path can observe waitcount == 0, free the structure, and return control to rdtgroup_kn_put(), which then reads freed memory. The fix wraps the atomic decrement with mutex acquisition to make the decrement and flag inspection mutually exclusive with the bulk freers. No authentication is required; the vulnerability is triggered through normal resctrl operations.
Affected products
- Linux Linux kernel Versions prior to the patch (exact version range not specified in advisory)
Timeline
- 2026-09-17: disclosed