{"id":"CVE-2026-93181","revision":"2d99a82992f646ac891f98f1622bddf9","records":[{"revision":"2d99a82992f646ac891f98f1622bddf9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-93181","aliases":[],"title":"perf/x86/intel/uncore: Fix uncore_box ref/unref ordering","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/uncore: Fix uncore_box ref/unref ordering\n\nIn uncore_event_cpu_online(), uncore_box_ref() was called before\nuncore_change_context().  uncore_box_ref() gates on box->cpu >= 0,\nbut box->cpu is still -1 at that point because uncore_change_context()\nhas not run yet.  As a result, the box is never initialized on the\nfirst CPU to come online in a die, leaving it permanently\nuninitialized in the single-CPU-per-die case.\n\nThus, box->refcnt is one count below the true value, and in the CPU\noffline path, the box will be torn down on the second-to-last CPU.\n\nIn uncore_event_cpu_offline(), uncore_box_unref() was called after\nuncore_change_context(), so box->cpu is already -1 when the collector\nCPU goes offline, which prevents it from tearing down the box.\n\nFix by swapping the call order in both paths so that\nuncore_box_{ref,unref}() runs at the point where box->cpu reflects\nthe correct context.\n\nMove allocate_boxes() out of uncore_box_ref() to enable this\nreordering.","state":0,"publishedAt":"2026-09-17T16:12:08.716+00:00","modifiedAt":"2026-10-21T12:52:12.996+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/x86/events/intel/uncore.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c74443d92f68f07c03ae242ced554b749e6c6736\",\n                            \"lessThan\": \"3cfd351602e6704cce9bc766a974afb9f745d44b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c74443d92f68f07c03ae242ced554b749e6c6736\",\n                            \"lessThan\": \"64aa1bb4017d598828c6d8cd718f43daf2a83375\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c74443d92f68f07c03ae242ced554b749e6c6736\",\n                            \"lessThan\": \"174f0582e38abe03b88e15f04bfe58490f88cb19\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/x86/events/intel/uncore.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.114\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/3cfd351602e6704cce9bc766a974afb9f745d44b","https://git.kernel.org/stable/c/64aa1bb4017d598828c6d8cd718f43daf2a83375","https://git.kernel.org/stable/c/174f0582e38abe03b88e15f04bfe58490f88cb19"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93181","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-93181","identifiers":["CVE-2026-93181"]},"retained":false,"historicalAffected":[]}],"coverage":[]}