VulnerabilityPublished 17 Sep 2026Updated 21 Oct 2026

CVE-2026-93181: Linux kernel · perf/x86/intel/uncore: Fix uncore_box ref/unref ordering

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in 174f0582e38abe03b88e15f04bfe58490f88cb19 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 174f0582e38abe03b88e15f04bfe58490f88cb19, 64aa1bb4017d598828c6d8cd718f43daf2a83375, 3cfd351602e6704cce9bc766a974afb9f745d44b

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to 174f0582e38abe03b88e15f04bfe58490f88cb19, 64aa1bb4017d598828c6d8cd718f43daf2a83375 or 3cfd351602e6704cce9bc766a974afb9f745d44b.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ c74443d92f68f07c03ae242ced554b749e6c6736, < 174f0582e38abe03b88e15f04bfe58490f88cb19	Fixed in 174f0582e38abe03b88e15f04bfe58490f88cb19
LinuxLinux	Affected ≥ c74443d92f68f07c03ae242ced554b749e6c6736, < 64aa1bb4017d598828c6d8cd718f43daf2a83375	Fixed in 64aa1bb4017d598828c6d8cd718f43daf2a83375
LinuxLinux	Affected ≥ c74443d92f68f07c03ae242ced554b749e6c6736, < 3cfd351602e6704cce9bc766a974afb9f745d44b	Fixed in 3cfd351602e6704cce9bc766a974afb9f745d44b
LinuxLinux	Affected =6.11	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering In uncore_event_cpu_online(), uncore_box_ref() was called before uncore_change_context(). uncore_box_ref() gates on box->cpu >= 0, but box->cpu is still -1 at that point because uncore_change_context() has not run yet. As a result, the box is never initialized on the first CPU to come online in a die, leaving it permanently uninitialized in the single-CPU-per-die case. Thus, box->refcnt is one count below the true value, and in the CPU offline path, the box will be torn down on the second-to-last CPU. In uncore_event_cpu_offline(), uncore_box_unref() was called after uncore_change_context(), so box->cpu is already -1 when the collector CPU goes offline, which prevents it from tearing down the box. Fix by swapping the call order in both paths so that uncore_box_{ref,unref}() runs at the point where box->cpu reflects the correct context. Move allocate_boxes() out of uncore_box_ref() to enable this reordering.

References

Community reviews

Loading reviews…