GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74606 (GCVE-0-2026-74606)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-08-25 05:40
VLAI
Title
eventfs: Fix use-after-free in eventfs_remove_rec()
Summary
In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfs_remove_rec() eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running. Use list_for_each_entry_safe() to save the next sibling before recursively removing the current child.
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5dfb04100326f70e3b2d2872c2476ed20b804837 , < b77581b25e213e83b79ce11eb30024e55ceeb3e9 (git)
Affected: 43aa6f97c2d03a52c1ddb86768575fc84344bdbb , < f161d7861a0bfdf10af6b738b3b57636204661fb (git)
Affected: 43aa6f97c2d03a52c1ddb86768575fc84344bdbb , < 5635211b44969f4816e29ec4d5f8665fb39535d0 (git)
Affected: 43aa6f97c2d03a52c1ddb86768575fc84344bdbb , < 74bb1eaf72d185a78c879eb2678ea500f82f46a8 (git)
Affected: 43aa6f97c2d03a52c1ddb86768575fc84344bdbb , < fd73b691702170d37d66f4b0278530cea8ed419a (git)
Affected: 5a43badefe0eccca0c26144c0a44b8d417ce8103 (git)
Affected: 6.6.18 , < 6.6.152 (semver)
Affected: 6.7.6 , < 6.8 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/tracefs/event_inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b77581b25e213e83b79ce11eb30024e55ceeb3e9",
              "status": "affected",
              "version": "5dfb04100326f70e3b2d2872c2476ed20b804837",
              "versionType": "git"
            },
            {
              "lessThan": "f161d7861a0bfdf10af6b738b3b57636204661fb",
              "status": "affected",
              "version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb",
              "versionType": "git"
            },
            {
              "lessThan": "5635211b44969f4816e29ec4d5f8665fb39535d0",
              "status": "affected",
              "version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb",
              "versionType": "git"
            },
            {
              "lessThan": "74bb1eaf72d185a78c879eb2678ea500f82f46a8",
              "status": "affected",
              "version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb",
              "versionType": "git"
            },
            {
              "lessThan": "fd73b691702170d37d66f4b0278530cea8ed419a",
              "status": "affected",
              "version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5a43badefe0eccca0c26144c0a44b8d417ce8103",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.152",
              "status": "affected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/tracefs/event_inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "6.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Fix use-after-free in eventfs_remove_rec()\n\neventfs_remove_rec() recursively removes the child at the current loop\nposition. After the recursive call returns, list_for_each_entry() advances\nby reading list.next from the removed child.\n\nIf free_ei() drops the final reference, release_ei() reuses the list/rcu\nunion to queue an SRCU callback. The child may be freed before that read.\nThe eventfs_mutex serializes list updates, but it does not keep the removed\nchild alive or prevent the SRCU callback from running.\n\nUse list_for_each_entry_safe() to save the next sibling before recursively\nremoving the current child."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - eventfs_remove_rec() is only reached via eventfs_remove_dir()/eventfs_remove_events_dir() during tracefs event teardown (instance rmdir, dynamic event removal, module unload); tracefs is a local pseudo-fs under /sys/kernel/tracing with no network, adjacent, or physical entry path.\nAC:L - The UAF is deterministic whenever a parent eventfs_inode has 2+ children: after recursively freeing the first child, list_for_each_entry() reads list.next from repurposed freed memory; an attacker can create multiple trace events then trigger parent teardown without uncontrollable races.\nPR:L - Exploitation needs local tracefs write (kprobe_events/dynamic_events to create events, rmdir on tracing instances); paths check LOCKDOWN_TRACEFS and DAC without capable(), and tracing-group gid mounts on Android/ChromeOS/dev systems commonly grant this to unprivileged users.\nUI:N - The attacker performs all tracefs operations to create multiple eventfs children and invoke teardown in their own session; no separate victim mount, click, or configuration action is required beyond tracefs already being accessible.\nS:U - The UAF corrupts kernel heap within the tracing/eventfs subsystem on the same host; it enables local privilege escalation but does not cross VM, IOMMU, container, or other security boundaries to a different authority.\nC:H - After free_ei(), release_ei() reuses the child\u0027s list/rcu union for SRCU teardown; list_for_each_entry() then reads list.next from freed/repurposed eventfs_inode memory, a standard kernel UAF read and information-disclosure primitive.\nI:H - Freed eventfs_inode slabs can be attacker-influenced via repeated trace-event create/delete; the corrupt sibling traversal enables heap grooming for arbitrary kernel writes and local privilege escalation, not merely a bounded crash.\nA:H - Reading list.next from a freed/repurposed eventfs_inode during recursive removal reliably causes invalid pointer dereferences, kernel oops, or panic; the fault is retriggerable by repeating trace-event setup and teardown cycles."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:31.060Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b77581b25e213e83b79ce11eb30024e55ceeb3e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f161d7861a0bfdf10af6b738b3b57636204661fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/5635211b44969f4816e29ec4d5f8665fb39535d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/74bb1eaf72d185a78c879eb2678ea500f82f46a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd73b691702170d37d66f4b0278530cea8ed419a"
        }
      ],
      "title": "eventfs: Fix use-after-free in eventfs_remove_rec()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74606",
    "datePublished": "2026-08-22T15:31:53.819Z",
    "dateReserved": "2026-08-15T05:44:03.920Z",
    "dateUpdated": "2026-08-25T05:40:31.060Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74606",
      "date": "2026-09-16",
      "epss": "0.00125",
      "percentile": "0.02545"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:42:53.000Z",
      "cve": "CVE-2026-74606",
      "id": "msrc_CVE-2026-74606",
      "initial_release_date": "2026-08-24T01:09:24.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "eventfs: Fix use-after-free in eventfs_remove_rec()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74606.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74606\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:33.077\",\"lastModified\":\"2026-08-25T06:18:37.160\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\neventfs: Fix use-after-free in eventfs_remove_rec()\\n\\neventfs_remove_rec() recursively removes the child at the current loop\\nposition. After the recursive call returns, list_for_each_entry() advances\\nby reading list.next from the removed child.\\n\\nIf free_ei() drops the final reference, release_ei() reuses the list/rcu\\nunion to queue an SRCU callback. The child may be freed before that read.\\nThe eventfs_mutex serializes list updates, but it does not keep the removed\\nchild alive or prevent the SRCU callback from running.\\n\\nUse list_for_each_entry_safe() to save the next sibling before recursively\\nremoving the current child.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/tracefs/event_inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5dfb04100326f70e3b2d2872c2476ed20b804837\",\"lessThan\":\"b77581b25e213e83b79ce11eb30024e55ceeb3e9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43aa6f97c2d03a52c1ddb86768575fc84344bdbb\",\"lessThan\":\"f161d7861a0bfdf10af6b738b3b57636204661fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43aa6f97c2d03a52c1ddb86768575fc84344bdbb\",\"lessThan\":\"5635211b44969f4816e29ec4d5f8665fb39535d0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43aa6f97c2d03a52c1ddb86768575fc84344bdbb\",\"lessThan\":\"74bb1eaf72d185a78c879eb2678ea500f82f46a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43aa6f97c2d03a52c1ddb86768575fc84344bdbb\",\"lessThan\":\"fd73b691702170d37d66f4b0278530cea8ed419a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a43badefe0eccca0c26144c0a44b8d417ce8103\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.18\",\"lessThan\":\"6.6.152\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.7.6\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/tracefs/event_inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5635211b44969f4816e29ec4d5f8665fb39535d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/74bb1eaf72d185a78c879eb2678ea500f82f46a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b77581b25e213e83b79ce11eb30024e55ceeb3e9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f161d7861a0bfdf10af6b738b3b57636204661fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fd73b691702170d37d66f4b0278530cea8ed419a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:50:33+00:00",
      "cve": "CVE-2026-74606",
      "id": "CVE-2026-74606",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: eventfs: Fix use-after-free in eventfs_remove_rec()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74606.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:17:58Z",
      "cve": "CVE-2026-74606",
      "id": "CVE-2026-74606",
      "initial_release_date": "2026-08-23T00:06:03Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "328",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74606",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74606.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…