CVE-2026-93099: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-qpj7-xpxx-33h9
Share
Published
Advisory Summary

CVE-2026-93099 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-93099 at a Glance

CVE Identifier CVE-2026-93099
GHSA Identifier GHSA-qpj7-xpxx-33h9
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-93099

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-93099, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix UAF from worker threads when domains are removed The mbm_handle_overflow() and cqm_handle_limbo() workers read event counters and may sleep while doing so. They are scheduled via delayed_work embedded in struct rdt_l3_mon_domain. Architecture allocates and frees these domains from CPU hotplug callbacks under cpus_write_lock(), and the workers acquire cpus_read_lock() to keep the domain alive across their access. A use-after-free can occur when a worker is blocked waiting for cpus_read_lock() while the hotplug core holds cpus_write_lock(): the architecture frees the rdt_l3_mon_domain that contains the worker's work_struct. When the worker unblocks, the container_of() it performs on the embedded work pointer dereferences freed memory. Drop cpus_read_lock() from the workers and instead drain pending and in-flight work synchronously before the architecture can free the domain. Since architecture offlines the domain under cpus_write_lock() after it has been unlinked from the RCU list and a grace period has elapsed, no new work can be scheduled. The cancel only needs to wait out existing work. Drop rdtgroup_mutex during CPU offline around cancel_delayed_work_sync() so that a worker waiting on the mutex can complete before re-pinning the work on a different CPU. When offlining a CPU the architecture may iterate over resources in any order. For example, the MBA control domain may be offlined before or after a corresponding L3 monitor domain. Ensure that resctrl fs cancels the workers no matter what order the architecture offlines the domains.

References

NVD — CVE-2026-93099 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93099
git.kernel.org/stable/c/2566b5cd6a... WEB
https://git.kernel.org/stable/c/2566b5cd6a275c124e8f154fef6e815f92ec8d5c
git.kernel.org/stable/c/6a2e023429... WEB
https://git.kernel.org/stable/c/6a2e023429a41afd0d9dfe74268aa51774a953ff
git.kernel.org/stable/c/b86dbfe458... WEB
https://git.kernel.org/stable/c/b86dbfe4583bf134932a6cc45bf25b12c10a0b2f

Frequently Asked Questions

What is CVE-2026-93099?
CVE-2026-93099 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-93099?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-93099?
CVE-2026-93099 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-93099?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qpj7-xpxx-33h9",
  "modified" : "2026-10-15T12:30:51Z",
  "published" : "2026-09-17T18:32:10Z",
  "aliases" : [ "CVE-2026-93099" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/resctrl: Fix UAF from worker threads when domains are removed\n\nThe mbm_handle_overflow() and cqm_handle_limbo() workers read event counters\nand may sleep while doing so. They are scheduled via delayed_work embedded in\nstruct rdt_l3_mon_domain. Architecture allocates and frees these domains from\nCPU hotplug callbacks under cpus_write_lock(), and the workers acquire\ncpus_read_lock() to keep the domain alive across their access.\n\nA use-after-free can occur when a worker is blocked waiting for\ncpus_read_lock() while the hotplug core holds cpus_write_lock(): the\narchitecture frees the rdt_l3_mon_domain that contains the worker's\nwork_struct. When the worker unblocks, the container_of() it performs on the\nembedded work pointer dereferences freed memory.\n\nDrop cpus_read_lock() from the workers and instead drain pending and in-flight\nwork synchronously before the architecture can free the domain.  Since\narchitecture offlines the domain under cpus_write_lock() after it has been\nunlinked from the RCU list and a grace period has elapsed, no new work can be\nscheduled. The cancel only needs to wait out existing work.  Drop\nrdtgroup_mutex during CPU offline around cancel_delayed_work_sync() so that\na worker waiting on the mutex can complete before re-pinning the work on\na different CPU.\n\nWhen offlining a CPU the architecture may iterate over resources in any order.\nFor example, the MBA control domain may be offlined before or after\na corresponding L3 monitor domain. Ensure that resctrl fs cancels the workers\nno matter what order the architecture offlines the domains.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-93099"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2566b5cd6a275c124e8f154fef6e815f92ec8d5c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6a2e023429a41afd0d9dfe74268aa51774a953ff"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b86dbfe4583bf134932a6cc45bf25b12c10a0b2f"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:18:04Z"
  }
}