In the Linux kernel, the following vulnerability has been resolved:
x86/resctrl: Clear staged_config[] before and after it is used
As a temporary storage, staged_config[] in rdt_domain should be cleared before and after it is used. The stale value in staged_config[] could cause an MSR access error.
Here is a reproducer on a system with 16 usable CLOSIDs for a 15-way L3 Cache (MBA should be disabled if the number of CLOSIDs for MB is less than 16.) : mount -t resctrl resctrl -o cdp /sys/fs/resctrl mkdir /sys/fs/resctrl/p{1..7} umount /sys/fs/resctrl/ mount -t resctrl resctrl /sys/fs/resctrl mkdir /sys/fs/resctrl/p{1..8}
An error occurs when creating resource group named p8: unchecked MSR access error: WRMSR to 0xca0 (tried to write 0x00000000000007ff) at rIP: 0xffffffff82249142 (cat_wrmsr+0x32/0x60) Call Trace: <IRQ> __flush_smp_call_function_queue+0x11d/0x170 __sysvec_call_function+0x24/0xd0 sysvec_call_function+0x89/0xc0 </IRQ> <TASK> asm_sysvec_call_function+0x16/0x20
When creating a new resource control group, hardware will be configured by the following process: rdtgroup_mkdir() rdtgroup_mkdir_ctrl_mon() rdtgroup_init_alloc() resctrl_arch_update_domains()
resctrl_arch_update_domains() iterates and updates all resctrl_conf_type whose have_new_ctrl is true. Since staged_config[] holds the same values as when CDP was enabled, it will continue to update the CDP_CODE and CDP_DATA configurations. When group p8 is created, get_config_index() called in resctrl_arch_update_domains() will return 16 and 17 as the CLOSIDs for CDP_CODE and CDP_DATA, which will be translated to an invalid register - 0xca0 in this scenario.
Fix it by clearing staged_config[] before and after it is used.
[reinette: re-order commit tags]
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.104-63.140Upgrade bpftoolUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade python-perfUpgrade bpftool-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-livepatch-6.1.21-1.45Upgrade kernel-libbpfUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade perfUpgrade kernel-tools-develUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-develUpgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64 | Sep 30, 2025 | Sep 15, 2025 |
| Debian | — | Upgrade linux | Sep 17, 2025 | Sep 17, 2025 |
| Ubuntu | — | Upgrade linux-intel-iotg-5.15Upgrade linux-intel-iotgUpgrade linux-riscv-5.15Upgrade linux-nvidiaUpgrade linux-realtimeUpgrade linux-gkeopUpgrade linux-ibm-5.15Upgrade linux-lowlatencyUpgrade linux-gkeUpgrade linux-gcpUpgrade linux-oracle-5.15Upgrade linux-gcp-5.15Upgrade linux-kvmUpgrade linux-raspiUpgrade linux-ibmUpgrade linux-intel-iot-realtimeUpgrade linux-xilinx-zynqmpUpgrade linux-azureUpgrade linux-oracleUpgrade linux-nvidia-tegra-igxUpgrade linux-azure-5.15Upgrade linux-nvidia-tegraUpgrade linux-hwe-5.15Upgrade linux-awsUpgrade linux-lowlatency-hwe-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linuxUpgrade linux-bluefieldUpgrade linux-aws-5.15 | Sep 19, 2025 | Sep 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub