CVE-2026-74606eventfs: Fix use-after-free in eventfs_remove_rec()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfs_remove_rec() eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running. Use list_for_each_entry_safe() to save the next sibling before recursively removing the current child.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5dfb04100326f70e3b2d2872c2476ed20b804837 before b77581b25e213e83b79ce11eb30024e55ceeb3e9; from 43aa6f97c2d03a52c1ddb86768575fc84344bdbb before f161d7861a0bfdf10af6b738b3b57636204661fb; from 43aa6f97c2d03a52c1ddb86768575fc84344bdbb before 5635211b44969f4816e29ec4d5f8665fb39535d0; from 43aa6f97c2d03a52c1ddb86768575fc84344bdbb before 74bb1eaf72d185a78c879eb2678ea500f82f46a8; from 43aa6f97c2d03a52c1ddb86768575fc84344bdbb before fd73b691702170d37d66f4b0278530cea8ed419a; 5a43badefe0eccca0c26144c0a44b8d417ce8103; from 6.6.18 before 6.6.152; from 6.7.6 before 6.8 | CNA record |
References
- https://git.kernel.org/stable/c/b77581b25e213e83b79ce11eb30024e55ceeb3e9
- https://git.kernel.org/stable/c/f161d7861a0bfdf10af6b738b3b57636204661fb
- https://git.kernel.org/stable/c/5635211b44969f4816e29ec4d5f8665fb39535d0
- https://git.kernel.org/stable/c/74bb1eaf72d185a78c879eb2678ea500f82f46a8
- https://git.kernel.org/stable/c/fd73b691702170d37d66f4b0278530cea8ed419a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.