GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-46106 (GCVE-0-2026-46106)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:35 – Updated: 2026-06-14 17:54
VLAI
Title
eventfs: Hold eventfs_mutex and SRCU when remount walks events
Summary
In the Linux kernel, the following vulnerability has been resolved: eventfs: Hold eventfs_mutex and SRCU when remount walks events Commit 340f0c7067a9 ("eventfs: Update all the eventfs_inodes from the events descriptor") had eventfs_set_attrs() recurse through ei->children on remount. The walk only holds the rcu_read_lock() taken by tracefs_apply_options() over tracefs_inodes, which is wrong: - list_for_each_entry over ei->children races with the list_del_rcu() in eventfs_remove_rec() -- LIST_POISON1 deref, same shape as d2603279c7d6. - eventfs_inodes are freed via call_srcu(&eventfs_srcu, ...). rcu_read_lock() does not extend an SRCU grace period, so ti->private can be reclaimed under the walk. - The writes to ei->attr race with eventfs_set_attr(), which holds eventfs_mutex. Reproducer: while :; do mount -o remount,uid=$((RANDOM%1000)) /sys/kernel/tracing; done & while :; do echo "p:kp submit_bio" > /sys/kernel/tracing/kprobe_events echo > /sys/kernel/tracing/kprobe_events done Wrap the events portion of tracefs_apply_options() in eventfs_remount_lock()/_unlock() that take eventfs_mutex and srcu_read_lock(&eventfs_srcu). eventfs_set_attrs() doesn't sleep so the nested rcu_read_lock() is fine; lockdep_assert_held() pins the contract. Comment in tracefs_drop_inode() said "RCU cycle" -- it is SRCU.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7ec535ed8724d18ae4e714d2277a5b89450659d2 , < ae9cd0b46b1890040006a2fc5e905c5d6053fd02 (git)
Affected: 340f0c7067a95281ad13734f8225f49c6cf52067 , < 44e64d8a432837308f4dda3ffe819f1ec092a0ba (git)
Affected: 340f0c7067a95281ad13734f8225f49c6cf52067 , < 52b109f1b875b912d4ab2c5fdd8c322d47119d9b (git)
Affected: 340f0c7067a95281ad13734f8225f49c6cf52067 , < ed2ad73bcb0a7a6cc934097d4853b6d5124c317e (git)
Affected: 340f0c7067a95281ad13734f8225f49c6cf52067 , < 07004a8c4b572171934390148ee48c4175c77eed (git)
Affected: 99b86d85f7c73d676c50e8c35748f94dd41389da (git)
Affected: 6.6.35 , < 6.6.140 (semver)
Affected: 6.9.6 , < 6.10 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.6.140 , ≤ 6.6.* (semver)
Unaffected: 6.12.88 , ≤ 6.12.* (semver)
Unaffected: 6.18.30 , ≤ 6.18.* (semver)
Unaffected: 7.0.7 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/tracefs/event_inode.c",
            "fs/tracefs/inode.c",
            "fs/tracefs/internal.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae9cd0b46b1890040006a2fc5e905c5d6053fd02",
              "status": "affected",
              "version": "7ec535ed8724d18ae4e714d2277a5b89450659d2",
              "versionType": "git"
            },
            {
              "lessThan": "44e64d8a432837308f4dda3ffe819f1ec092a0ba",
              "status": "affected",
              "version": "340f0c7067a95281ad13734f8225f49c6cf52067",
              "versionType": "git"
            },
            {
              "lessThan": "52b109f1b875b912d4ab2c5fdd8c322d47119d9b",
              "status": "affected",
              "version": "340f0c7067a95281ad13734f8225f49c6cf52067",
              "versionType": "git"
            },
            {
              "lessThan": "ed2ad73bcb0a7a6cc934097d4853b6d5124c317e",
              "status": "affected",
              "version": "340f0c7067a95281ad13734f8225f49c6cf52067",
              "versionType": "git"
            },
            {
              "lessThan": "07004a8c4b572171934390148ee48c4175c77eed",
              "status": "affected",
              "version": "340f0c7067a95281ad13734f8225f49c6cf52067",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "99b86d85f7c73d676c50e8c35748f94dd41389da",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.140",
              "status": "affected",
              "version": "6.6.35",
              "versionType": "semver"
            },
            {
              "lessThan": "6.10",
              "status": "affected",
              "version": "6.9.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/tracefs/event_inode.c",
            "fs/tracefs/inode.c",
            "fs/tracefs/internal.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.9.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Hold eventfs_mutex and SRCU when remount walks events\n\nCommit 340f0c7067a9 (\"eventfs: Update all the eventfs_inodes from the\nevents descriptor\") had eventfs_set_attrs() recurse through ei-\u003echildren\non remount.  The walk only holds the rcu_read_lock() taken by\ntracefs_apply_options() over tracefs_inodes, which is wrong:\n\n  - list_for_each_entry over ei-\u003echildren races with the list_del_rcu()\n    in eventfs_remove_rec() -- LIST_POISON1 deref, same shape as\n    d2603279c7d6.\n  - eventfs_inodes are freed via call_srcu(\u0026eventfs_srcu, ...).\n    rcu_read_lock() does not extend an SRCU grace period, so ti-\u003eprivate\n    can be reclaimed under the walk.\n  - The writes to ei-\u003eattr race with eventfs_set_attr(), which holds\n    eventfs_mutex.\n\nReproducer:\n\n  while :; do mount -o remount,uid=$((RANDOM%1000)) /sys/kernel/tracing; done \u0026\n  while :; do\n      echo \"p:kp submit_bio\" \u003e /sys/kernel/tracing/kprobe_events\n      echo \u003e /sys/kernel/tracing/kprobe_events\n  done\n\nWrap the events portion of tracefs_apply_options() in\neventfs_remount_lock()/_unlock() that take eventfs_mutex and\nsrcu_read_lock(\u0026eventfs_srcu).  eventfs_set_attrs() doesn\u0027t sleep so the\nnested rcu_read_lock() is fine; lockdep_assert_held() pins the contract.\n\nComment in tracefs_drop_inode() said \"RCU cycle\" -- it is SRCU."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:54:53.367Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae9cd0b46b1890040006a2fc5e905c5d6053fd02"
        },
        {
          "url": "https://git.kernel.org/stable/c/44e64d8a432837308f4dda3ffe819f1ec092a0ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/52b109f1b875b912d4ab2c5fdd8c322d47119d9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed2ad73bcb0a7a6cc934097d4853b6d5124c317e"
        },
        {
          "url": "https://git.kernel.org/stable/c/07004a8c4b572171934390148ee48c4175c77eed"
        }
      ],
      "title": "eventfs: Hold eventfs_mutex and SRCU when remount walks events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46106",
    "datePublished": "2026-05-28T09:35:11.034Z",
    "dateReserved": "2026-05-13T15:03:33.097Z",
    "dateUpdated": "2026-06-14T17:54:53.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46106",
      "date": "2026-09-15",
      "epss": "0.00122",
      "percentile": "0.02232"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-09T14:44:27.000Z",
      "cve": "CVE-2026-46106",
      "id": "msrc_CVE-2026-46106",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "eventfs: Hold eventfs_mutex and SRCU when remount walks events",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46106.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46106\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-28T10:16:25.950\",\"lastModified\":\"2026-06-25T21:18:59.773\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\neventfs: Hold eventfs_mutex and SRCU when remount walks events\\n\\nCommit 340f0c7067a9 (\\\"eventfs: Update all the eventfs_inodes from the\\nevents descriptor\\\") had eventfs_set_attrs() recurse through ei-\u003echildren\\non remount.  The walk only holds the rcu_read_lock() taken by\\ntracefs_apply_options() over tracefs_inodes, which is wrong:\\n\\n  - list_for_each_entry over ei-\u003echildren races with the list_del_rcu()\\n    in eventfs_remove_rec() -- LIST_POISON1 deref, same shape as\\n    d2603279c7d6.\\n  - eventfs_inodes are freed via call_srcu(\u0026eventfs_srcu, ...).\\n    rcu_read_lock() does not extend an SRCU grace period, so ti-\u003eprivate\\n    can be reclaimed under the walk.\\n  - The writes to ei-\u003eattr race with eventfs_set_attr(), which holds\\n    eventfs_mutex.\\n\\nReproducer:\\n\\n  while :; do mount -o remount,uid=$((RANDOM%1000)) /sys/kernel/tracing; done \u0026\\n  while :; do\\n      echo \\\"p:kp submit_bio\\\" \u003e /sys/kernel/tracing/kprobe_events\\n      echo \u003e /sys/kernel/tracing/kprobe_events\\n  done\\n\\nWrap the events portion of tracefs_apply_options() in\\neventfs_remount_lock()/_unlock() that take eventfs_mutex and\\nsrcu_read_lock(\u0026eventfs_srcu).  eventfs_set_attrs() doesn\u0027t sleep so the\\nnested rcu_read_lock() is fine; lockdep_assert_held() pins the contract.\\n\\nComment in tracefs_drop_inode() said \\\"RCU cycle\\\" -- it is SRCU.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/tracefs/event_inode.c\",\"fs/tracefs/inode.c\",\"fs/tracefs/internal.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7ec535ed8724d18ae4e714d2277a5b89450659d2\",\"lessThan\":\"ae9cd0b46b1890040006a2fc5e905c5d6053fd02\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"340f0c7067a95281ad13734f8225f49c6cf52067\",\"lessThan\":\"44e64d8a432837308f4dda3ffe819f1ec092a0ba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"340f0c7067a95281ad13734f8225f49c6cf52067\",\"lessThan\":\"52b109f1b875b912d4ab2c5fdd8c322d47119d9b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"340f0c7067a95281ad13734f8225f49c6cf52067\",\"lessThan\":\"ed2ad73bcb0a7a6cc934097d4853b6d5124c317e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"340f0c7067a95281ad13734f8225f49c6cf52067\",\"lessThan\":\"07004a8c4b572171934390148ee48c4175c77eed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"99b86d85f7c73d676c50e8c35748f94dd41389da\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.35\",\"lessThan\":\"6.6.140\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.9.6\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/tracefs/event_inode.c\",\"fs/tracefs/inode.c\",\"fs/tracefs/internal.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.140\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.88\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.30\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.7\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.35\",\"versionEndExcluding\":\"6.6.140\",\"matchCriteriaId\":\"B0173BEF-84A2-4374-8237-47E948C1D986\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9.6\",\"versionEndExcluding\":\"6.12.88\",\"matchCriteriaId\":\"C08EF979-9FB8-4108-83C6-C519594C5222\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.30\",\"matchCriteriaId\":\"BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.7\",\"matchCriteriaId\":\"D0893CA7-9AE6-4DFE-AC75-48967D73AD8E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/07004a8c4b572171934390148ee48c4175c77eed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/44e64d8a432837308f4dda3ffe819f1ec092a0ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/52b109f1b875b912d4ab2c5fdd8c322d47119d9b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae9cd0b46b1890040006a2fc5e905c5d6053fd02\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ed2ad73bcb0a7a6cc934097d4853b6d5124c317e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-27T16:20:42+00:00",
      "cve": "CVE-2026-46106",
      "id": "CVE-2026-46106",
      "initial_release_date": "2026-05-28T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: eventfs: Hold eventfs_mutex and SRCU when remount walks events",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46106.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-07T02:20:24Z",
      "cve": "CVE-2026-46106",
      "id": "CVE-2026-46106",
      "initial_release_date": "2026-05-29T01:17:08Z",
      "product_status:known_affected": "30",
      "product_status:known_not_affected": "179",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46106",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46106.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.