---
id: CVE-2026-74605
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  eventfs: Use children field for rcu head and add memory barriers

  When an eventfs inode is freed, it sets ei->is_freed and then uses its
  ei->list to add it to the srcu …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  eventfs: Use children field for rcu head and add memory barriers

  When an eventfs inode is freed, it sets ei->is_freed and then uses its
  ei->list to add it to the srcu …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 704f960dbee2f1634f4b4e16f208cb16eaf41c1e <
    2b80707b9e27671e10840d17c6f8f774c4ad9847
  - >-
    Linux >= 704f960dbee2f1634f4b4e16f208cb16eaf41c1e <
    004f7232e49730448f91665e76bdd7dff8e0c638
  - >-
    Linux >= 704f960dbee2f1634f4b4e16f208cb16eaf41c1e <
    f0ece16ffca7384787b692431961ce202907acf5
  - Linux f3f41f444b321ec393edbc251e024fd62658ce55
  - Linux 305c4e4d80aca2c2d9cf2ebdea56e2eca6d3a6aa
  - Linux >= 6.6.18 < 6.7
  - Linux >= 6.7.6 < 6.8
  - Linux 6.8
published: '2026-08-22'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:48.277'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74605'
references:
  - url: 'https://git.kernel.org/stable/c/004f7232e49730448f91665e76bdd7dff8e0c638'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2b80707b9e27671e10840d17c6f8f774c4ad9847'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f0ece16ffca7384787b692431961ce202907acf5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/25d27d5fa8645ab61018c3efec5c69f49280ca7d'
  - url: 'https://git.kernel.org/stable/c/1b95382da85cff3bf0f922ff0275f186abdadfce'
tags:
  - nvd
  - cve.org
epss: 0.00129
epssPercentile: 0.02529
ingestedAt: '2026-10-14T13:30:58.513Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Use children field for rcu head and add memory barriers

When an eventfs inode is freed, it sets ei->is_freed and then uses its
ei->list to add it to the srcu link list as the list field is a union with
the rcu list head. As the ei->list is used to iterate over an SRCU
protected list without taking the eventfs_mutex, there's nothing stopping
the iteration over that list to see the ei->rcu instead of the ei->list
and it will read a corrupt target.

To fix this, change the union of the rcu list head with the children list.
On freeing the eventfs inode, set the is_free and execute a smp_wmb()
before adding the eventfs inode to the SRCU list.

On iteration of the ei->children list, at the start, execute a smp_rmb()
and then read the is_freed of the ei to see if the children list is still
valid. If is_freed is set, then the ei_child read is not valid and the
loop should exit immediately.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.