Executive brief
A vulnerability was identified in the Linux kernel's eventpoll (epoll) subsystem, which manages how applications monitor multiple file descriptors for activity. A flaw in how the system removes monitored files could allow a local attacker to trigger a 'use-after-free' condition, potentially leading to a system crash or unauthorized memory manipulation. This issue primarily impacts system stability and could be leveraged to disrupt operations or compromise kernel integrity.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's eventpoll (epoll) implementation within the ep_remove() function. The root cause is a race condition where ep_remove() clears a file's epoll pointer under a lock but continues to use the file object after a concurrent process has already initiated the file's release. In specific 'epoll-watches-epoll' scenarios, this leads to memory corruption as the kernel attempts to write to already freed memory. Additionally, because file structures are managed via RCU, an attacker could potentially influence memory recycling to trigger an incorrect slab cache free. The fix involves pinning the file object via epi_fget() to ensure its reference count remains above zero throughout the critical section, preventing premature cleanup.
Affected products
- Linux Linux Kernel Versions prior to May 2026 patches
Timeline
- 2026-04-23: patched: Initial patch authored by Christian Brauner
- 2026-05-30: disclosed: CVE published to NVD