CVE-2026-93181: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-93181 is a reference counting ordering flaw in the Linux kernel's perf/x86/intel/uncore subsystem that can cause performance monitoring infrastructure to be torn down prematurely during CPU hotplug operations. The vulnerability was published on September 17, 2026, and affects Linux kernel versions starting from 6.11 up to (but not including) the commits that introduce the fix (64aa1bb4017d and 174f0582e38a). Fixed versions include kernel 7.2.6 and 7.3-rc1. The CVSS base score is listed as 0.0 with a category estimate of Medium; no formal severity rating has been assigned at this time (GitHub Advisory, Feedly).

The root cause is an incorrect call ordering in the perf/x86/intel/uncore subsystem's CPU hotplug callbacks (CWE classification not formally assigned). In uncore_event_cpu_online(), uncore_box_ref() was invoked before uncore_change_context(), but uncore_box_ref() gates on box->cpu >= 0 — a condition that is not yet true because box->cpu remains -1 until uncore_change_context() runs. This causes the uncore box to remain permanently uninitialized on the first CPU to come online in a die (particularly in single-CPU-per-die configurations), leaving box->refcnt one count below the true value. Symmetrically, in uncore_event_cpu_offline(), uncore_box_unref() was called after uncore_change_context(), so box->cpu is already -1 when the collector CPU goes offline, preventing proper teardown. The fix swaps the call order in both paths and moves allocate_boxes() out of uncore_box_ref() to enable the reordering (GitHub Advisory).

A local user with the ability to trigger CPU hotplug operations can cause the uncore performance monitoring infrastructure to be torn down prematurely on the second-to-last CPU rather than the last, resulting in malfunctioning uncore performance counters and potential system instability or monitoring service failures. The impact is primarily a denial of service against performance monitoring capabilities, with no evidence of confidentiality or integrity compromise. The vulnerability is limited to systems using Intel uncore performance monitoring on multi-die or single-CPU-per-die configurations running affected kernel versions (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date. The vulnerability requires local access and the ability to trigger CPU hotplug operations, significantly limiting the attack surface. The EPSS score is 0.0, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, GitHub Advisory).

Apply the Linux kernel patch that reorders the uncore_box_ref() / uncore_change_context() calls in both uncore_event_cpu_online() and uncore_event_cpu_offline() paths, and moves allocate_boxes() out of uncore_box_ref(). Fixed commits are 64aa1bb4017d598828c6d8cd718f43daf2a83375 and 174f0582e38abe03b88e15f04bfe58490f88cb19; update to kernel version 7.2.6 or 7.3-rc1 or later. No configuration-based workaround is documented; upgrading to a patched kernel version is the recommended remediation (GitHub Advisory, Kernel Patch 1, Kernel Patch 2).