Linux Linux Kernel Vulnerability Rated 7.8 CVSS

Status: UPDATED  |  Advisory ID: CVE-2026-74605

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Use children field for rcu head and add memory barriers

When an eventfs inode is freed, it sets ei->is_freed and then uses its

ei->list to add it to the srcu link list as the list field is a union with

the rcu list head. As the ei->list is used to iterate over an SRCU

protected list without taking the eventfs_mutex, there's nothing stopping

the iteration over that list to see the ei->rcu instead of the ei->list

and it will read a corrupt target.

To fix this, change the union of the rcu list head with the children list.

On freeing the eventfs inode, set the is_free and execute a smp_wmb()

before adding the eventfs inode to the SRCU list.

On iteration of the ei->children list, at the start, execute a smp_rmb()

and then read the is_freed of the ei to see if the children list is still

valid. If is_freed is set, then the ei_child read is not valid and the

loop should exit immediately. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References