CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec()

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-22 · updated 2026-10-14

Description

In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfs_remove_rec() eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running. Use list_for_each_entry_safe() to save the next sibling before recursively removing the current child.

Affected products

Linux kernel: from 6.6.18 before 6.6.152; from 6.7.6 before 6.8; 6.8 — fixed in 6.6.152, 6.8, 7.2

How to fix

Upgrade to a fixed version: Linux kernel 6.6.152, 6.8, 7.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-74606 or the next vulnerability affects your stack