eventfs: Use children field for rcu head and add memory barriers
In the Linux kernel, the following vulnerability has been resolved: eventfs: Use children field for rcu head and add memory barriers When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list field is a union with the rcu list head. As the ei->list is used to iterate over an SRCU protected list without taking the eventfs_mutex, there's nothing stopping the iteration over that list to see the ei->rcu instead of the ei->list and it will read a corrupt target. To fix this, change the union of the rcu list head with the children list. On freeing the eventfs inode, set the is_free and execute a smp_wmb() before adding the eventfs inode to the SRCU list. On iteration of the ei->children list, at the start, execute a smp_rmb() and then read the is_freed of the ei to see if the children list is still valid. If is_freed is set, then the ei_child read is not valid and the loop should exit immediately.
CVE-2026-74605
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-74605
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "f3f41f444b321ec393edbc251e024fd62658ce55",
"lessThan": "25d27d5fa8645ab61018c3efec5c69f49280ca7d",
"versionType": "git"
},
{
"status": "affected",
"version": "704f960dbee2f1634f4b4e16f208cb16eaf41c1e",
"lessThan": "1b95382da85cff3bf0f922ff0275f186abdadfce",
"versionType": "git"
},
{
"status": "affected",
"version": "704f960dbee2f1634f4b4e16f208cb16eaf41c1e",
"lessThan": "2b80707b9e27671e10840d17c6f8f774c4ad9847",
"versionType": "git"
},
{
"status": "affected",
"version": "704f960dbee2f1634f4b4e16f208cb16eaf41c1e",
"lessThan": "004f7232e49730448f91665e76bdd7dff8e0c638",
"versionType": "git"
},
{
"status": "affected",
"version": "704f960dbee2f1634f4b4e16f208cb16eaf41c1e",
"lessThan": "f0ece16ffca7384787b692431961ce202907acf5",
"versionType": "git"
},
{
"status": "affected",
"version": "305c4e4d80aca2c2d9cf2ebdea56e2eca6d3a6aa",
"versionType": "git"
},
{
"status": "affected",
"version": "6.6.18",
"lessThan": "6.6.160",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.7.6",
"lessThan": "6.8",
"versionType": "semver"
}
],
"programFiles": [
"fs/tracefs/event_inode.c",
"fs/tracefs/internal.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.8",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/tracefs/event_inode.c",
"fs/tracefs/internal.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-74605
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #46582 · Revision 1
- Added to Heist Feed
- Publisher date