Executive brief
A vulnerability was identified in the Linux kernel's tracing subsystem (eventfs) that could lead to a system crash. The issue occurs when the system attempts to update file permissions or ownership on the tracing filesystem while tracing events are simultaneously being added or removed. This race condition can cause the kernel to access memory that has already been freed, resulting in a denial-of-service (system crash).
Technical details
A race condition exists in the eventfs implementation within the Linux kernel's tracefs subsystem. When `tracefs_apply_options` is called during a remount, it recurses through `eventfs_inodes` while only holding `rcu_read_lock()`. This is insufficient because `eventfs_inodes` are managed via Sleepable RCU (SRCU), and the standard RCU lock does not prevent the underlying data from being reclaimed. Additionally, the walk races with `eventfs_remove_rec()`, potentially leading to a `LIST_POISON1` dereference. An attacker with local access could trigger this by repeatedly remounting the tracing filesystem while toggling kprobe events, leading to a kernel panic. The fix involves properly wrapping the remount walk with `eventfs_mutex` and `srcu_read_lock`.
Affected products
- Linux Linux Kernel 6.6 to 6.9.x
Timeline
- 2026-04-18: patched: Initial patch submitted by David Carlier
- 2026-05-28: disclosed: CVE-2026-46106 published
References
- https://git.kernel.org/stable/c/07004a8c4b572171934390148ee48c4175c77eed
- https://git.kernel.org/stable/c/44e64d8a432837308f4dda3ffe819f1ec092a0ba
- https://git.kernel.org/stable/c/52b109f1b875b912d4ab2c5fdd8c322d47119d9b
- https://git.kernel.org/stable/c/ae9cd0b46b1890040006a2fc5e905c5d6053fd02
- https://git.kernel.org/stable/c/ed2ad73bcb0a7a6cc934097d4853b6d5124c317e