CVE-2026-64477

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled<br /> <br /> The architecture updates the cpu_mask in a domain&amp;#39;s header to track which<br /> online CPUs are associated with the domain. When this mask becomes empty<br /> the architecture initiates offline of the domain that includes calling<br /> on resctrl fs to offline the domain. If it is a monitoring domain in<br /> which LLC occupancy is tracked resctrl fs forces the limbo handler to<br /> clear all busy RMID state associated with the domain.<br /> <br /> The limbo handler always reads the current event value associated with a<br /> busy RMID irrespective of it being checked as part of regular "is it still<br /> busy" check or whether it will be forced released anyway. When reading an<br /> RMID on a system with SNC enabled the "logical RMID" is converted to the<br /> "physical RMID" and this conversion requires the NUMA node ID of the<br /> resctrl monitoring domain that is in turn determined by querying the NUMA<br /> node ID of any CPU belonging to the monitoring domain.<br /> <br /> When the monitoring domain is going offline its cpu_mask is empty causing<br /> the NUMA node ID query via cpu_to_node() to be done with "nr_cpu_ids" as<br /> argument resulting in an out-of-bounds access.<br /> <br /> Refactor the limbo handler to skip reading the RMID when the RMID will<br /> just be forced to no longer be dirty in the domain anyway. Add a safety<br /> check to the architecture&amp;#39;s RMID reader to protect against this scenario.