CVE-2026-74606 - Vulnerability Details

- eventfs: Fix use-after-free in eventfs_remove_rec()

Description

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Fix use-after-free in eventfs_remove_rec()

eventfs_remove_rec() recursively removes the child at the current loop
position. After the recursive call returns, list_for_each_entry() advances
by reading list.next from the removed child.

If free_ei() drops the final reference, release_ei() reuses the list/rcu
union to queue an SRCU callback. The child may be freed before that read.
The eventfs_mutex serializes list updates, but it does not keep the removed
child alive or prevent the SRCU callback from running.

Use list_for_each_entry_safe() to save the next sibling before recursively
removing the current child.

Published: 2026-08-22

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

A bug in the Linux kernel’s eventfs subsystem causes a use‑after‑free. The recursive removal of child entries in eventfs_remove_rec() can free an event data instance while a subsequent list traversal still accesses it. This flaw could allow an attacker to manipulate the eventfs filesystem and trigger a crash or arbitrary code execution within the kernel. The weakness is categorized as CWE‑416.

Affected Systems

The vulnerability affects systems running the Linux kernel when the eventfs filesystem is enabled. No specific kernel versions are listed, but the patch is included in all kernel releases after the commit that introduces the safe list traversal guard.

Risk and Exploitability

The CVSS score is not provided, yet CWE‑416 flaws are generally considered high‑severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely exploitation path requires local privileged access or the ability to create and manipulate eventfs entries. Once triggered, the kernel may crash or execute arbitrary code, compromising system confidentiality, integrity, and availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5dfb04100326f70e3b2d2872c2476ed20b804837`	affected	< b77581b25e213e83b79ce11eb30024e55ceeb3e9
`43aa6f97c2d03a52c1ddb86768575fc84344bdbb`	affected	< f161d7861a0bfdf10af6b738b3b57636204661fb
`43aa6f97c2d03a52c1ddb86768575fc84344bdbb`	affected	< 5635211b44969f4816e29ec4d5f8665fb39535d0
`43aa6f97c2d03a52c1ddb86768575fc84344bdbb`	affected	< 74bb1eaf72d185a78c879eb2678ea500f82f46a8
`43aa6f97c2d03a52c1ddb86768575fc84344bdbb`	affected	< fd73b691702170d37d66f4b0278530cea8ed419a
`5a43badefe0eccca0c26144c0a44b8d417ce8103`	affected	—
`6.6.18`	affected	< 6.6.152
`6.7.6`	affected	< 6.8

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5dfb04100326f70e3b2d2872c2476ed20b804837,b77581b25e213e83b79ce11eb30024e55ceeb3e9)`	affected	code_commit	—
`[43aa6f97c2d03a52c1ddb86768575fc84344bdbb,f161d7861a0bfdf10af6b738b3b57636204661fb)`	affected	code_commit	—
`[43aa6f97c2d03a52c1ddb86768575fc84344bdbb,5635211b44969f4816e29ec4d5f8665fb39535d0)`	affected	code_commit	—
`[43aa6f97c2d03a52c1ddb86768575fc84344bdbb,74bb1eaf72d185a78c879eb2678ea500f82f46a8)`	affected	code_commit	—
`[43aa6f97c2d03a52c1ddb86768575fc84344bdbb,fd73b691702170d37b66f4b0278530cea8ed419a)`	affected	code_commit	—
`43aa6f97c2d03a52c1ddb86768575fc84344bdbb`	affected	code_commit	—
`5a43badefe0eccca0c26144c0a44b8d417ce8103`	affected	code_commit	—
`[6.6.18,6.6.152)`	affected	semver	—
`[6.7.6,6.8)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.8`	affected	generic	—
`[0,6.8)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the eventfs_remove_rec() fix based on commit 5635211b44969f48.
Disable the eventfs filesystem if it is not needed, e.g., by ensuring it is not mounted or by removing the mount point.
If disabled builds are not an option, rebuild the kernel with CONFIG_EVENTFS disabled to eliminate the vulnerable code path.

Generated by OpenCVE AI on August 22, 2026 at 16:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/5635211b44969f4816e29ec4d5f8665fb39535d0
https://git.kernel.org/stable/c/74bb1eaf72d185a78c879eb2678ea500f82f46a8
https://git.kernel.org/stable/c/b77581b25e213e83b79ce11eb30024e55ceeb3e9
https://git.kernel.org/stable/c/f161d7861a0bfdf10af6b738b3b57636204661fb
https://git.kernel.org/stable/c/fd73b691702170d37d66f4b0278530cea8ed419a

History

Sat, 22 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfs_remove_rec() eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running. Use list_for_each_entry_safe() to save the next sibling before recursively removing the current child.
Title		eventfs: Fix use-after-free in eventfs_remove_rec()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5635211b44969f4816e29ec4d5f8665fb39535d0 https://git.kernel.org/stable/c/74bb1eaf72d185a78c879eb2678ea500f82f46a8 https://git.kernel.org/stable/c/b77581b25e213e83b79ce11eb30024e55ceeb3e9 https://git.kernel.org/stable/c/f161d7861a0bfdf10af6b738b3b57636204661fb https://git.kernel.org/stable/c/fd73b691702170d37d66f4b0278530cea8ed419a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:31:53.819Z

Updated: 2026-08-22T15:31:53.819Z

Reserved: 2026-08-15T05:44:03.920Z

Link: CVE-2026-74606

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:33.077

Modified: 2026-08-22T16:16:33.077

Link: CVE-2026-74606

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-22T18:00:04Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object