CVE-2026-93181

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/intel/uncore: Fix uncore_box ref/unref ordering

In uncore_event_cpu_online(), uncore_box_ref() was called before

uncore_change_context(). uncore_box_ref() gates on box->cpu >= 0,

but box->cpu is still -1 at that point because uncore_change_context()

has not run yet. As a result, the box is never initialized on the

first CPU to come online in a die, leaving it permanently

uninitialized in the single-CPU-per-die case.

Thus, box->refcnt is one count below the true value, and in the CPU

offline path, the box will be torn down on the second-to-last CPU.

In uncore_event_cpu_offline(), uncore_box_unref() was called after

uncore_change_context(), so box->cpu is already -1 when the collector

CPU goes offline, which prevents it from tearing down the box.

Fix by swapping the call order in both paths so that

uncore_box_{ref,unref}() runs at the point where box->cpu reflects

the correct context.

Move allocate_boxes

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References