CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled

The architecture updates the cpu_mask in a domain's header to track which
online CPUs are associated with the domain. When this mask becomes empty
the architecture initiates offline of the domain that includes calling
on resctrl fs to offline the domain. If it is a monitoring domain in
which LLC occupancy is tracked resctrl fs forces the limbo handler to
clear all busy RMID state associated with the domain.

The limbo handler always reads the current event value associated with a
busy RMID irrespective of it being checked as part of regular "is it still
busy" check or whether it will be forced released anyway. When reading an
RMID on a system with SNC enabled the "logical RMID" is converted to the
"physical RMID" and this conversion requires the NUMA node ID of the
resctrl monitoring domain that is in turn determined by querying the NUMA
node ID of any CPU belonging to the monitoring domain.

When the monitoring domain is going offline its cpu_mask is empty causing
the NUMA node ID query via cpu_to_node() to be done with "nr_cpu_ids" as
argument resulting in an out-of-bounds access.

Refactor the limbo handler to skip reading the RMID when the RMID will
just be forced to no longer be dirty in the domain anyway. Add a safety
check to the architecture's RMID reader to protect against this scenario.

The Linux kernel CVE team has assigned CVE-2026-64477 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.11 with commit e13db55b5a0d447dea63cde772c1078405bbbf96 and fixed in 6.12.96 with commit ebc300b7ee0c669fa76a7a8858298ff32e296103
	Issue introduced in 6.11 with commit e13db55b5a0d447dea63cde772c1078405bbbf96 and fixed in 6.18.39 with commit be1567992417dc92133e74126de7a6066c825ac9
	Issue introduced in 6.11 with commit e13db55b5a0d447dea63cde772c1078405bbbf96 and fixed in 7.1.4 with commit 58c5ec23b1a238eb75cb0aba6f69d8f9e68ef0b2
	Issue introduced in 6.11 with commit e13db55b5a0d447dea63cde772c1078405bbbf96 and fixed in 7.2-rc2 with commit fc16126cc11d9f507130bf84ab137ee0938c900e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64477
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/x86/kernel/cpu/resctrl/monitor.c
	fs/resctrl/monitor.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ebc300b7ee0c669fa76a7a8858298ff32e296103
	https://git.kernel.org/stable/c/be1567992417dc92133e74126de7a6066c825ac9
	https://git.kernel.org/stable/c/58c5ec23b1a238eb75cb0aba6f69d8f9e68ef0b2
	https://git.kernel.org/stable/c/fc16126cc11d9f507130bf84ab137ee0938c900e