CVE-2026-74606
Received Received - Intake

eventfs Use-After-Free in Linux Kernel

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfs_remove_rec() eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running. Use list_for_each_entry_safe() to save the next sibling before recursively removing the current child.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74606
EUVD
EUVD-2026-64543

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's eventfs file system. The issue occurs in eventfs_remove_rec() when recursively removing child entries. The function uses list_for_each_entry() which reads list.next after the current child is removed, but if the child is freed before that read, it can lead to accessing invalid memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's eventfs component and requires kernel-level inspection. Detection involves checking kernel logs for crashes or errors related to eventfs operations. Use commands like dmesg | grep eventfs or journalctl -k | grep eventfs to search for related errors. If you suspect exploitation, monitor for unusual process crashes or system instability.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or potential privilege escalation if exploited.

Mitigation Strategies

Immediate mitigation requires updating the Linux kernel to a patched version that includes the fix for eventfs_remove_rec(). Check your distribution's security advisories for kernel updates. If updating is not immediately possible, avoid using eventfs-dependent features or services until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74606. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart