GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74605 (GCVE-0-2026-74605)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-08-25 05:40
VLAI
Title
eventfs: Use children field for rcu head and add memory barriers
Summary
In the Linux kernel, the following vulnerability has been resolved: eventfs: Use children field for rcu head and add memory barriers When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list field is a union with the rcu list head. As the ei->list is used to iterate over an SRCU protected list without taking the eventfs_mutex, there's nothing stopping the iteration over that list to see the ei->rcu instead of the ei->list and it will read a corrupt target. To fix this, change the union of the rcu list head with the children list. On freeing the eventfs inode, set the is_free and execute a smp_wmb() before adding the eventfs inode to the SRCU list. On iteration of the ei->children list, at the start, execute a smp_rmb() and then read the is_freed of the ei to see if the children list is still valid. If is_freed is set, then the ei_child read is not valid and the loop should exit immediately.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 704f960dbee2f1634f4b4e16f208cb16eaf41c1e , < 004f7232e49730448f91665e76bdd7dff8e0c638 (git)
Affected: 704f960dbee2f1634f4b4e16f208cb16eaf41c1e , < f0ece16ffca7384787b692431961ce202907acf5 (git)
Affected: f3f41f444b321ec393edbc251e024fd62658ce55 (git)
Affected: 305c4e4d80aca2c2d9cf2ebdea56e2eca6d3a6aa (git)
Affected: 6.6.18 , < 6.7 (semver)
Affected: 6.7.6 , < 6.8 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/tracefs/event_inode.c",
            "fs/tracefs/internal.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "004f7232e49730448f91665e76bdd7dff8e0c638",
              "status": "affected",
              "version": "704f960dbee2f1634f4b4e16f208cb16eaf41c1e",
              "versionType": "git"
            },
            {
              "lessThan": "f0ece16ffca7384787b692431961ce202907acf5",
              "status": "affected",
              "version": "704f960dbee2f1634f4b4e16f208cb16eaf41c1e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f3f41f444b321ec393edbc251e024fd62658ce55",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "305c4e4d80aca2c2d9cf2ebdea56e2eca6d3a6aa",
              "versionType": "git"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/tracefs/event_inode.c",
            "fs/tracefs/internal.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Use children field for rcu head and add memory barriers\n\nWhen an eventfs inode is freed, it sets ei-\u003eis_freed and then uses its\nei-\u003elist to add it to the srcu link list as the list field is a union with\nthe rcu list head. As the ei-\u003elist is used to iterate over an SRCU\nprotected list without taking the eventfs_mutex, there\u0027s nothing stopping\nthe iteration over that list to see the ei-\u003ercu instead of the ei-\u003elist\nand it will read a corrupt target.\n\nTo fix this, change the union of the rcu list head with the children list.\nOn freeing the eventfs inode, set the is_free and execute a smp_wmb()\nbefore adding the eventfs inode to the SRCU list.\n\nOn iteration of the ei-\u003echildren list, at the start, execute a smp_rmb()\nand then read the is_freed of the ei to see if the children list is still\nvalid. If is_freed is set, then the ei_child read is not valid and the\nloop should exit immediately."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local syscalls (getdents64/readdir on tracefs eventfs directories through eventfs_iterate); tracefs is a kernel pseudo-filesystem under /sys/kernel/tracing with no network, adjacent-wireless, or physical-device entry path.\nAC:L - A single multithreaded attacker can loop getdents on events/ or events/kprobes/ while concurrently adding/removing kprobes via kprobe_events writes that call eventfs_remove_dir; the attacker controls both the SRCU list walk and the free path, making the race reliably triggerable.\nPR:L - Exploitation needs only local tracefs read/write access (getdents plus kprobe_events to create/remove eventfs children); kprobe_events checks only LOCKDOWN_TRACEFS and DAC with no capable(), and tracing-group gid mounts, Android/ChromeOS, and developer systems commonly grant this to unprivileged users.\nUI:N - The attacker performs all concurrent directory reads and dynamic event removals in their own process; no separate victim mount, click, or configuration action is required beyond tracefs already being accessible on the system.\nS:U - The union misuse causes kernel heap/list corruption and use-after-free within the tracing filesystem subsystem on the same host; it does not cross VM, container, IOMMU, or other security boundaries to affect a different authority.\nC:H - During list_for_each_entry_srcu over ei-\u003echildren, a concurrently freed child repurposes ei-\u003elist (union with rcu_head) for SRCU teardown, so the iterator follows corrupt list pointers and dereferences freed or attacker-influenced kernel memory typical of UAF read primitives.\nI:H - Corrupt SRCU list traversal over freed eventfs_inode objects is classic kernel UAF memory corruption that can be combined with heap grooming from repeated kprobe create/delete to obtain arbitrary kernel writes and local privilege escalation, not merely a bounded crash.\nA:H - Following a child\u0027s list.next after the list/rcu union is switched during free_ei() readily causes invalid pointer dereferences, kernel oops, or panic; the race can be retriggered at will by alternating getdents with dynamic event teardown."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:29.836Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/004f7232e49730448f91665e76bdd7dff8e0c638"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0ece16ffca7384787b692431961ce202907acf5"
        }
      ],
      "title": "eventfs: Use children field for rcu head and add memory barriers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74605",
    "datePublished": "2026-08-22T15:31:53.063Z",
    "dateReserved": "2026-08-15T05:44:03.919Z",
    "dateUpdated": "2026-08-25T05:40:29.836Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74605",
      "date": "2026-09-17",
      "epss": "0.0012",
      "percentile": "0.02137"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:46:30.000Z",
      "cve": "CVE-2026-74605",
      "id": "msrc_CVE-2026-74605",
      "initial_release_date": "2026-08-24T01:03:04.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "eventfs: Use children field for rcu head and add memory barriers",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74605.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74605\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:32.977\",\"lastModified\":\"2026-08-25T06:18:36.947\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\neventfs: Use children field for rcu head and add memory barriers\\n\\nWhen an eventfs inode is freed, it sets ei-\u003eis_freed and then uses its\\nei-\u003elist to add it to the srcu link list as the list field is a union with\\nthe rcu list head. As the ei-\u003elist is used to iterate over an SRCU\\nprotected list without taking the eventfs_mutex, there\u0027s nothing stopping\\nthe iteration over that list to see the ei-\u003ercu instead of the ei-\u003elist\\nand it will read a corrupt target.\\n\\nTo fix this, change the union of the rcu list head with the children list.\\nOn freeing the eventfs inode, set the is_free and execute a smp_wmb()\\nbefore adding the eventfs inode to the SRCU list.\\n\\nOn iteration of the ei-\u003echildren list, at the start, execute a smp_rmb()\\nand then read the is_freed of the ei to see if the children list is still\\nvalid. If is_freed is set, then the ei_child read is not valid and the\\nloop should exit immediately.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/tracefs/event_inode.c\",\"fs/tracefs/internal.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"704f960dbee2f1634f4b4e16f208cb16eaf41c1e\",\"lessThan\":\"004f7232e49730448f91665e76bdd7dff8e0c638\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"704f960dbee2f1634f4b4e16f208cb16eaf41c1e\",\"lessThan\":\"f0ece16ffca7384787b692431961ce202907acf5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3f41f444b321ec393edbc251e024fd62658ce55\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"305c4e4d80aca2c2d9cf2ebdea56e2eca6d3a6aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.18\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.7.6\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/tracefs/event_inode.c\",\"fs/tracefs/internal.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/004f7232e49730448f91665e76bdd7dff8e0c638\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0ece16ffca7384787b692431961ce202907acf5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:50:30+00:00",
      "cve": "CVE-2026-74605",
      "id": "CVE-2026-74605",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: eventfs: Use children field for rcu head and add memory barriers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74605.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:18:00Z",
      "cve": "CVE-2026-74605",
      "id": "CVE-2026-74605",
      "initial_release_date": "2026-09-02T01:04:07Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "328",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74605",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74605.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.