{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-74606", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.920Z", "datePublished": "2026-08-22T15:31:53.819Z", "dateUpdated": "2026-08-25T05:40:31.060Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:31.060Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Fix use-after-free in eventfs_remove_rec()\n\neventfs_remove_rec() recursively removes the child at the current loop\nposition. After the recursive call returns, list_for_each_entry() advances\nby reading list.next from the removed child.\n\nIf free_ei() drops the final reference, release_ei() reuses the list/rcu\nunion to queue an SRCU callback. The child may be freed before that read.\nThe eventfs_mutex serializes list updates, but it does not keep the removed\nchild alive or prevent the SRCU callback from running.\n\nUse list_for_each_entry_safe() to save the next sibling before recursively\nremoving the current child." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - eventfs_remove_rec() is only reached via eventfs_remove_dir()/eventfs_remove_events_dir() during tracefs event teardown (instance rmdir, dynamic event removal, module unload); tracefs is a local pseudo-fs under /sys/kernel/tracing with no network, adjacent, or physical entry path.\nAC:L - The UAF is deterministic whenever a parent eventfs_inode has 2+ children: after recursively freeing the first child, list_for_each_entry() reads list.next from repurposed freed memory; an attacker can create multiple trace events then trigger parent teardown without uncontrollable races.\nPR:L - Exploitation needs local tracefs write (kprobe_events/dynamic_events to create events, rmdir on tracing instances); paths check LOCKDOWN_TRACEFS and DAC without capable(), and tracing-group gid mounts on Android/ChromeOS/dev systems commonly grant this to unprivileged users.\nUI:N - The attacker performs all tracefs operations to create multiple eventfs children and invoke teardown in their own session; no separate victim mount, click, or configuration action is required beyond tracefs already being accessible.\nS:U - The UAF corrupts kernel heap within the tracing/eventfs subsystem on the same host; it enables local privilege escalation but does not cross VM, IOMMU, container, or other security boundaries to a different authority.\nC:H - After free_ei(), release_ei() reuses the child's list/rcu union for SRCU teardown; list_for_each_entry() then reads list.next from freed/repurposed eventfs_inode memory, a standard kernel UAF read and information-disclosure primitive.\nI:H - Freed eventfs_inode slabs can be attacker-influenced via repeated trace-event create/delete; the corrupt sibling traversal enables heap grooming for arbitrary kernel writes and local privilege escalation, not merely a bounded crash.\nA:H - Reading list.next from a freed/repurposed eventfs_inode during recursive removal reliably causes invalid pointer dereferences, kernel oops, or panic; the fault is retriggerable by repeating trace-event setup and teardown cycles." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/tracefs/event_inode.c" ], "versions": [ { "version": "5dfb04100326f70e3b2d2872c2476ed20b804837", "lessThan": "b77581b25e213e83b79ce11eb30024e55ceeb3e9", "status": "affected", "versionType": "git" }, { "version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb", "lessThan": "f161d7861a0bfdf10af6b738b3b57636204661fb", "status": "affected", "versionType": "git" }, { "version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb", "lessThan": "5635211b44969f4816e29ec4d5f8665fb39535d0", "status": "affected", "versionType": "git" }, { "version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb", "lessThan": "74bb1eaf72d185a78c879eb2678ea500f82f46a8", "status": "affected", "versionType": "git" }, { "version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb", "lessThan": "fd73b691702170d37d66f4b0278530cea8ed419a", "status": "affected", "versionType": "git" }, { "version": "5a43badefe0eccca0c26144c0a44b8d417ce8103", "status": "affected", "versionType": "git" }, { "version": "6.6.18", "lessThan": "6.6.152", "status": "affected", "versionType": "semver" }, { "version": "6.7.6", "lessThan": "6.8", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/tracefs/event_inode.c" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.18", "versionEndExcluding": "6.6.152" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.104" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.45" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.1.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.6" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b77581b25e213e83b79ce11eb30024e55ceeb3e9" }, { "url": "https://git.kernel.org/stable/c/f161d7861a0bfdf10af6b738b3b57636204661fb" }, { "url": "https://git.kernel.org/stable/c/5635211b44969f4816e29ec4d5f8665fb39535d0" }, { "url": "https://git.kernel.org/stable/c/74bb1eaf72d185a78c879eb2678ea500f82f46a8" }, { "url": "https://git.kernel.org/stable/c/fd73b691702170d37d66f4b0278530cea8ed419a" } ], "title": "eventfs: Fix use-after-free in eventfs_remove_rec()", "x_generator": { "engine": "bippy-1.2.0" } } } }