Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-74606

eventfs: Fix use-after-free in eventfs_remove_rec()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfs_remove_rec() eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running. Use list_for_each_entry_safe() to save the next sibling before recursively removing the current child.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 5dfb04100326f70e3b2d2872c2476ed20b804837 to < b77581b25e213e83b79ce11eb30024e55ceeb3e9affected
  • 43aa6f97c2d03a52c1ddb86768575fc84344bdbb to < f161d7861a0bfdf10af6b738b3b57636204661fbaffected
  • 43aa6f97c2d03a52c1ddb86768575fc84344bdbb to < 5635211b44969f4816e29ec4d5f8665fb39535d0affected
  • 43aa6f97c2d03a52c1ddb86768575fc84344bdbb to < 74bb1eaf72d185a78c879eb2678ea500f82f46a8affected
  • 43aa6f97c2d03a52c1ddb86768575fc84344bdbb to < fd73b691702170d37d66f4b0278530cea8ed419aaffected
  • 5a43badefe0eccca0c26144c0a44b8d417ce8103affected
  • 6.6.18 to < 6.6.152affected
  • 6.7.6 to < 6.8affected

Linux Linux

Default version status: affected

  • 6.8affected
  • 0 to < 6.8unaffected
  • 6.6.152 to ≤ 6.6.*unaffected
  • 6.12.104 to ≤ 6.12.*unaffected
  • 6.18.45 to ≤ 6.18.*unaffected
  • 7.1.9 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References