{"id":"CVE-2026-74605","title":"In the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Use children field for rcu head and add memory barriers\n\nWhen an eventfs inode is freed, it sets ei->is_freed and then uses its\nei->list to add it to the srcu …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Use children field for rcu head and add memory barriers\n\nWhen an eventfs inode is freed, it sets ei->is_freed and then uses its\nei->list to add it to the srcu …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 704f960dbee2f1634f4b4e16f208cb16eaf41c1e < 2b80707b9e27671e10840d17c6f8f774c4ad9847","Linux >= 704f960dbee2f1634f4b4e16f208cb16eaf41c1e < 004f7232e49730448f91665e76bdd7dff8e0c638","Linux >= 704f960dbee2f1634f4b4e16f208cb16eaf41c1e < f0ece16ffca7384787b692431961ce202907acf5","Linux f3f41f444b321ec393edbc251e024fd62658ce55","Linux 305c4e4d80aca2c2d9cf2ebdea56e2eca6d3a6aa","Linux >= 6.6.18 < 6.7","Linux >= 6.7.6 < 6.8","Linux 6.8"],"published":"2026-08-22","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:48.277","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74605","references":[{"url":"https://git.kernel.org/stable/c/004f7232e49730448f91665e76bdd7dff8e0c638","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2b80707b9e27671e10840d17c6f8f774c4ad9847","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0ece16ffca7384787b692431961ce202907acf5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/25d27d5fa8645ab61018c3efec5c69f49280ca7d"},{"url":"https://git.kernel.org/stable/c/1b95382da85cff3bf0f922ff0275f186abdadfce"}],"tags":["nvd","cve.org"],"epss":0.00129,"epssPercentile":0.02488,"ingestedAt":"2026-10-14T13:30:58.513Z","slug":"CVE-2026-74605","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Use children field for rcu head and add memory barriers\n\nWhen an eventfs inode is freed, it sets ei->is_freed and then uses its\nei->list to add it to the srcu link list as the list field is a union with\nthe rcu list head. As the ei->list is used to iterate over an SRCU\nprotected list without taking the eventfs_mutex, there's nothing stopping\nthe iteration over that list to see the ei->rcu instead of the ei->list\nand it will read a corrupt target.\n\nTo fix this, change the union of the rcu list head with the children list.\nOn freeing the eventfs inode, set the is_free and execute a smp_wmb()\nbefore adding the eventfs inode to the SRCU list.\n\nOn iteration of the ei->children list, at the start, execute a smp_rmb()\nand then read the is_freed of the ei to see if the children list is still\nvalid. If is_freed is set, then the ei_child read is not valid and the\nloop should exit immediately.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}