CVE-2026-72080

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

fs/resctrl: Fix use-after-free during unmount

During unmount or failure teardown all mon_data structures that contain

monitoring event file private data are freed after which kernfs nodes are

removed. However, the RDT_DELETED flag is never set for the statically

allocated default resource group.

A concurrent reader of an event file associated with the default resource

group may, after dropping kernfs active protection, block on rdtgroup_mutex

while unmount proceeds to free the file private data and destroy the kernfs

node without waiting for the reader.

When the mutex is released, the reader wakes up, observes that RDT_DELETED

is not set for the default group, and dereferences the already-freed

file private data.

The scenario can be depicted as follows:

CPU0 CPU1

/*

* Default resource group's

* monitoring data accessible via

* kernfs file with kernfs_node::priv

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References