CVE-2026-72080

Status: UPDATED  |  Advisory ID: CVE-2026-72080

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

fs/resctrl: Fix use-after-free during unmount

During unmount or failure teardown all mon_data structures that contain

monitoring event file private data are freed after which kernfs nodes are

removed. However, the RDT_DELETED flag is never set for the statically

allocated default resource group.

A concurrent reader of an event file associated with the default resource

group may, after dropping kernfs active protection, block on rdtgroup_mutex

while unmount proceeds to free the file private data and destroy the kernfs

node without waiting for the reader.

When the mutex is released, the reader wakes up, observes that RDT_DELETED

is not set for the default group, and dereferences the already-freed

file private data.

The scenario can be depicted as follows:

CPU0 CPU1

/*

* Default resource group's

* monitoring data accessible via

* kernfs file with kernfs_node::priv

* pointing to a struct mon_data.

* User opens the file for reading.

*/

rdtgroup_mondata_show() /* arch encounters fatal error */

rdtgroup_kn_lock_live() resctrl_exit()

atomic_inc(&rdtgroup_default.waitcount) cpus_read_lock()

kernfs_break_active_protection(kn) mutex_lock(&rdtgroup_mutex)

cpus_read_lock() resctrl_fs_teardown()

mutex_lock(&rdtgroup_mutex) rmdir_all_sub()

mon_put_kn_priv()

/* Delete all mon_data structures */

rdtgroup_destroy_root()

kernfs_destroy_root()

rdtgroup_default.kn = NULL

mutex_unlock(&rdtgroup_mutex)

/*

* rdtgroup_default.flags is empty so

* rdtgroup_kn_lock_live() returns

* &rdtgroup_default

*/

md = of->kn->priv;

/* md points to freed mon_data */

Set RDT_DELETED for the default group unconditionally since the flag does

not lead to the freeing of this statically allocated group.

Do not allow a new resctrl mount if there are any waiters on default group

of previous mount. A new mount will re-initialize the default group that

would appear to waiters from previous mount as though the default group is

accessible causing them to access the mon_data structures from the previous

mount that have been removed. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References