CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-22 · updated 2026-10-21

Description

In the Linux kernel, the following vulnerability has been resolved: eventfs: Use children field for rcu head and add memory barriers When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list field is a union with the rcu list head. As the ei->list is used to iterate over an SRCU protected list without taking the eventfs_mutex, there's nothing stopping the iteration over that list to see the ei->rcu instead of the ei->list and it will read a corrupt target. To fix this, change the union of the rcu list head with the children list. On freeing the eventfs inode, set the is_free and execute a smp_wmb() before adding the eventfs inode to the SRCU list. On iteration of the ei->children list, at the start, execute a smp_rmb() and then read the is_freed of the ei to see if the children list is still valid. If is_freed is set, then the ei_child read is not valid and the loop should exit immediately.

Affected products

Linux kernel: from 6.6.18 before 6.6.160; from 6.7.6 before 6.8; 6.8 — fixed in 6.6.160, 6.8, 7.2

How to fix

Upgrade to a fixed version: Linux kernel 6.6.160, 6.8, 7.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-74605 or the next vulnerability affects your stack