CVE-2026-74606

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74606", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.920Z", "datePublished": "2026-08-22T15:31:53.819Z", "dateUpdated": "2026-08-25T05:40:31.060Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:31.060Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Fix use-after-free in eventfs_remove_rec()\n\neventfs_remove_rec() recursively removes the child at the current loop\nposition. After the recursive call returns, list_for_each_entry() advances\nby reading list.next from the removed child.\n\nIf free_ei() drops the final reference, release_ei() reuses the list/rcu\nunion to queue an SRCU callback. The child may be freed before that read.\nThe eventfs_mutex serializes list updates, but it does not keep the removed\nchild alive or prevent the SRCU callback from running.\n\nUse list_for_each_entry_safe() to save the next sibling before recursively\nremoving the current child."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - eventfs_remove_rec() is only reached via eventfs_remove_dir()/eventfs_remove_events_dir() during tracefs event teardown (instance rmdir, dynamic event removal, module unload); tracefs is a local pseudo-fs under /sys/kernel/tracing with no network, adjacent, or physical entry path.\nAC:L - The UAF is deterministic whenever a parent eventfs_inode has 2+ children: after recursively freeing the first child, list_for_each_entry() reads list.next from repurposed freed memory; an attacker can create multiple trace events then trigger parent teardown without uncontrollable races.\nPR:L - Exploitation needs local tracefs write (kprobe_events/dynamic_events to create events, rmdir on tracing instances); paths check LOCKDOWN_TRACEFS and DAC without capable(), and tracing-group gid mounts on Android/ChromeOS/dev systems commonly grant this to unprivileged users.\nUI:N - The attacker performs all tracefs operations to create multiple eventfs children and invoke teardown in their own session; no separate victim mount, click, or configuration action is required beyond tracefs already being accessible.\nS:U - The UAF corrupts kernel heap within the tracing/eventfs subsystem on the same host; it enables local privilege escalation but does not cross VM, IOMMU, container, or other security boundaries to a different authority.\nC:H - After free_ei(), release_ei() reuses the child's list/rcu union for SRCU teardown; list_for_each_entry() then reads list.next from freed/repurposed eventfs_inode memory, a standard kernel UAF read and information-disclosure primitive.\nI:H - Freed eventfs_inode slabs can be attacker-influenced via repeated trace-event create/delete; the corrupt sibling traversal enables heap grooming for arbitrary kernel writes and local privilege escalation, not merely a bounded crash.\nA:H - Reading list.next from a freed/repurposed eventfs_inode during recursive removal reliably causes invalid pointer dereferences, kernel oops, or panic; the fault is retriggerable by repeating trace-event setup and teardown cycles."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/tracefs/event_inode.c"], "versions": [{"version": "5dfb04100326f70e3b2d2872c2476ed20b804837", "lessThan": "b77581b25e213e83b79ce11eb30024e55ceeb3e9", "status": "affected", "versionType": "git"}, {"version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb", "lessThan": "f161d7861a0bfdf10af6b738b3b57636204661fb", "status": "affected", "versionType": "git"}, {"version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb", "lessThan": "5635211b44969f4816e29ec4d5f8665fb39535d0", "status": "affected", "versionType": "git"}, {"version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb", "lessThan": "74bb1eaf72d185a78c879eb2678ea500f82f46a8", "status": "affected", "versionType": "git"}, {"version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb", "lessThan": "fd73b691702170d37d66f4b0278530cea8ed419a", "status": "affected", "versionType": "git"}, {"version": "5a43badefe0eccca0c26144c0a44b8d417ce8103", "status": "affected", "versionType": "git"}, {"version": "6.6.18", "lessThan": "6.6.152", "status": "affected", "versionType": "semver"}, {"version": "6.7.6", "lessThan": "6.8", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/tracefs/event_inode.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.18", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b77581b25e213e83b79ce11eb30024e55ceeb3e9"}, {"url": "https://git.kernel.org/stable/c/f161d7861a0bfdf10af6b738b3b57636204661fb"}, {"url": "https://git.kernel.org/stable/c/5635211b44969f4816e29ec4d5f8665fb39535d0"}, {"url": "https://git.kernel.org/stable/c/74bb1eaf72d185a78c879eb2678ea500f82f46a8"}, {"url": "https://git.kernel.org/stable/c/fd73b691702170d37d66f4b0278530cea8ed419a"}], "title": "eventfs: Fix use-after-free in eventfs_remove_rec()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/tracefs/event_inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b77581b25e213e83b79ce11eb30024e55ceeb3e9", "status": "affected", "version": "5dfb04100326f70e3b2d2872c2476ed20b804837", "versionType": "git"}, {"lessThan": "f161d7861a0bfdf10af6b738b3b57636204661fb", "status": "affected", "version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb", "versionType": "git"}, {"lessThan": "5635211b44969f4816e29ec4d5f8665fb39535d0", "status": "affected", "version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb", "versionType": "git"}, {"lessThan": "74bb1eaf72d185a78c879eb2678ea500f82f46a8", "status": "affected", "version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb", "versionType": "git"}, {"lessThan": "fd73b691702170d37d66f4b0278530cea8ed419a", "status": "affected", "version": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb", "versionType": "git"}, {"status": "affected", "version": "5a43badefe0eccca0c26144c0a44b8d417ce8103", "versionType": "git"}, {"lessThan": "6.6.152", "status": "affected", "version": "6.6.18", "versionType": "semver"}, {"lessThan": "6.8", "status": "affected", "version": "6.7.6", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/tracefs/event_inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Fix use-after-free in eventfs_remove_rec()\n\neventfs_remove_rec() recursively removes the child at the current loop\nposition. After the recursive call returns, list_for_each_entry() advances\nby reading list.next from the removed child.\n\nIf free_ei() drops the final reference, release_ei() reuses the list/rcu\nunion to queue an SRCU callback. The child may be freed before that read.\nThe eventfs_mutex serializes list updates, but it does not keep the removed\nchild alive or prevent the SRCU callback from running.\n\nUse list_for_each_entry_safe() to save the next sibling before recursively\nremoving the current child."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\neventfs: Soluci\u00f3n para el uso despu\u00e9s de liberaci\u00f3n en eventfs_remove_rec()\n\neventfs_remove_rec() elimina recursivamente el hijo en la posici\u00f3n actual del bucle. Despu\u00e9s de que la llamada recursiva regresa, list_for_each_entry() avanza leyendo list.next del hijo eliminado.\n\nSi free_ei() libera la referencia final, release_ei() reutiliza la uni\u00f3n list/rcu para encolar una llamada de retorno SRCU. El hijo puede ser liberado antes de esa lectura. El eventfs_mutex serializa las actualizaciones de la lista, pero no mantiene vivo al hijo eliminado ni evita que se ejecute la llamada de retorno SRCU.\n\nUtilizar list_for_each_entry_safe() para guardar el siguiente hermano antes de eliminar recursivamente el hijo actual."}], "id": "CVE-2026-74606", "lastModified": "2026-10-14T13:10:00.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-22T16:16:33.077", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5635211b44969f4816e29ec4d5f8665fb39535d0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/74bb1eaf72d185a78c879eb2678ea500f82f46a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b77581b25e213e83b79ce11eb30024e55ceeb3e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f161d7861a0bfdf10af6b738b3b57636204661fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fd73b691702170d37d66f4b0278530cea8ed419a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: eventfs: Fix use-after-free in eventfs_remove_rec()", "id": "2521372", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521372"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's eventfs component. The `eventfs_remove_rec()` function contains a use-after-free vulnerability where it attempts to access memory after it has been deallocated. This can occur during recursive removal of child entries. A local attacker could exploit this flaw to cause memory corruption, potentially leading to a denial of service or arbitrary code execution."], "name": "CVE-2026-74606", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74606\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74606\nhttps://lore.kernel.org/linux-cve-announce/2026082216-CVE-2026-74606-f26d@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5dfb04100326f70e3b2d2872c2476ed20b804837,b77581b25e213e83b79ce11eb30024e55ceeb3e9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[43aa6f97c2d03a52c1ddb86768575fc84344bdbb,f161d7861a0bfdf10af6b738b3b57636204661fb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[43aa6f97c2d03a52c1ddb86768575fc84344bdbb,5635211b44969f4816e29ec4d5f8665fb39535d0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[43aa6f97c2d03a52c1ddb86768575fc84344bdbb,74bb1eaf72d185a78c879eb2678ea500f82f46a8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[43aa6f97c2d03a52c1ddb86768575fc84344bdbb,fd73b691702170d37b66f4b0278530cea8ed419a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "43aa6f97c2d03a52c1ddb86768575fc84344bdbb"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "5a43badefe0eccca0c26144c0a44b8d417ce8103"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.18,6.6.152)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.7.6,6.8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T17:00:10.933190+00:00", "updated": "2026-08-25T06:30:04.608813+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-825"]}