{
  "cveId": "CVE-2026-93099",
  "url": "https://patchblox.com/security/cve/CVE-2026-93099",
  "summary": "CVE-2026-93099 is fixed in linux on 1 platform by DEBIAN-CVE-2026-93099 (version 7.2.6-1), released September 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "fs/resctrl: Fix UAF from worker threads when domains are removed",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  fs/resctrl: Fix UAF from worker threads when domains are removed  The mbm_handle_overflow() and cqm_handle_limbo() workers read event counters and may sleep while doing so. They are scheduled via delayed_work embedded in struct rdt_l3_mon_domain. Architecture allocates and frees these domains from CPU hotplug callbacks under cpus_write_lock(), and the workers acquire cpus_read_lock() to keep the domain alive across their access.  A use-after-free can occur when a worker is blocked waiting for cpus_read_lock() while the hotplug core holds cpus_write_lock(): the architecture frees the rdt_l3_mon_domain that contains the worker\u0027s work_struct. When the worker unblocks, the container_of() it performs on the embedded work pointer dereferences freed memory.  Drop cpus_read_lock() from the workers and instead drain pending and in-flight work synchronously before the architecture can free the domain.  Since architecture offlines the domain under cpus_write_lock() after it has been unlinked from the RCU list and a grace period has elapsed, no new work can be scheduled. The cancel only needs to wait out existing work.  Drop rdtgroup_mutex during CPU offline around cancel_delayed_work_sync() so that a worker waiting on the mutex can complete before re-pinning the work on a different CPU.  When offlining a CPU the architecture may iterate over resources in any order. For example, the MBA control domain may be offlined before or after a corresponding L3 monitor domain. Ensure that resctrl fs cancels the workers no matter what order the architecture offlines the domains.",
  "published": "2026-09-17T17:18:04Z",
  "severity": "Moderate",
  "cvss": 5.5,
  "epss": 0.00206,
  "epssPercentile": 0.10779,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-93099",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-93099",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93099",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}