Executive brief
The Linux kernel's eventfs subsystem (which provides debugging interfaces for kernel event tracing) has a race condition where list iteration can read corrupted data after an inode is freed. An attacker with local access could exploit this to cause a kernel crash or potentially execute arbitrary code, disrupting system stability and availability.
Technical details
The vulnerability is a use-after-free and race condition in eventfs inode freeing and SRCU-protected list iteration. The vulnerable code path occurs when an eventfs inode is freed while another CPU is iterating the ei->children list without holding the eventfs_mutex. The root cause is a union between ei->rcu (RCU head) and ei->list (children list), allowing the freed inode's RCU head to overwrite the list structure, causing the iterator to read a corrupted next pointer. The fix adds a union between ei->children and ei->rcu (instead of ei->list), and introduces memory barriers: smp_wmb() when setting is_freed during freeing, and smp_rmb() + is_freed check during iteration. This prevents readers from using ei->children data after it has been repurposed for SRCU. The vulnerability requires local system access and affects SRCU-protected list iteration paths in fs/tracefs/event_inode.c.
Affected products
- Linux Linux kernel Multiple versions (eventfs subsystem)
Timeline
- 2026-08-22: disclosed: CVE-2026-74605 published
- 2026-08-08: patched: Patch commit f0ece16ffca7 authored by Steven Rostedt
- 2026-08-19: patched: Patch merged to stable tree by Greg Kroah-Hartman