Executive brief
A vulnerability was identified in the Linux kernel's event notification system (eventpoll), which is used by applications to efficiently monitor multiple file descriptors. A local attacker could exploit this flaw to cause a system crash or potentially execute unauthorized code by triggering a 'use-after-free' condition. This issue affects the stability and security of the operating system, potentially allowing an unprivileged user to gain elevated control over the system.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's eventpoll implementation (fs/eventpoll.c). The function ep_free() can kfree the 'struct eventpoll' while it is still being accessed by a concurrent thread, specifically during an RCU walk in ep_get_upwards_depth_proc(). This race condition occurs because the memory is released before all active references are cleared. An attacker with local access can exploit this to trigger memory corruption. The fix involves deferring the freeing of the struct to an RCU grace period using kfree_rcu() to ensure no concurrent threads are still accessing the structure. Patches have been released for various stable kernel branches including 6.6.y, 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 6.4.1 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-03-31: other: Patch authored by Nicholas Carlini
- 2026-05-06: disclosed: CVE published by kernel.org
- 2026-05-06: advisory
- 2026-05-20: other: NVD initial analysis completed
References
- https://git.kernel.org/stable/c/07712db80857d5d09ae08f3df85a708ecfc3b61f
- https://git.kernel.org/stable/c/5b1173b165421561db29f30afc7e97d940a398a9
- https://git.kernel.org/stable/c/7e8083f5eeedab0f460063b9c2c14c9a4e71a427
- https://git.kernel.org/stable/c/a6566cd33f6f967a7651ebf2ce0dd31572e319cf
- https://git.kernel.org/stable/c/ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322