{"id":"CVE-2026-74605","revision":"3ea4b88a5bbf4439b4fb46c8876decc8","records":[{"revision":"3ea4b88a5bbf4439b4fb46c8876decc8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74605","aliases":[],"title":"eventfs: Use children field for rcu head and add memory barriers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Use children field for rcu head and add memory barriers\n\nWhen an eventfs inode is freed, it sets ei->is_freed and then uses its\nei->list to add it to the srcu link list as the list field is a union with\nthe rcu list head. As the ei->list is used to iterate over an SRCU\nprotected list without taking the eventfs_mutex, there's nothing stopping\nthe iteration over that list to see the ei->rcu instead of the ei->list\nand it will read a corrupt target.\n\nTo fix this, change the union of the rcu list head with the children list.\nOn freeing the eventfs inode, set the is_free and execute a smp_wmb()\nbefore adding the eventfs inode to the SRCU list.\n\nOn iteration of the ei->children list, at the start, execute a smp_rmb()\nand then read the is_freed of the ei to see if the children list is still\nvalid. If is_freed is set, then the ei_child read is not valid and the\nloop should exit immediately.","state":0,"publishedAt":"2026-08-22T15:31:53.063+00:00","modifiedAt":"2026-10-21T12:46:03.903+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/tracefs/event_inode.c\",\n                        \"fs/tracefs/internal.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f3f41f444b321ec393edbc251e024fd62658ce55\",\n                            \"lessThan\": \"25d27d5fa8645ab61018c3efec5c69f49280ca7d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"704f960dbee2f1634f4b4e16f208cb16eaf41c1e\",\n                            \"lessThan\": \"1b95382da85cff3bf0f922ff0275f186abdadfce\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"704f960dbee2f1634f4b4e16f208cb16eaf41c1e\",\n                            \"lessThan\": \"2b80707b9e27671e10840d17c6f8f774c4ad9847\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"704f960dbee2f1634f4b4e16f208cb16eaf41c1e\",\n                            \"lessThan\": \"004f7232e49730448f91665e76bdd7dff8e0c638\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"704f960dbee2f1634f4b4e16f208cb16eaf41c1e\",\n                            \"lessThan\": \"f0ece16ffca7384787b692431961ce202907acf5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"305c4e4d80aca2c2d9cf2ebdea56e2eca6d3a6aa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.6.18\",\n                            \"lessThan\": \"6.6.160\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.7.6\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/tracefs/event_inode.c\",\n                        \"fs/tracefs/internal.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.114\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.9\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/25d27d5fa8645ab61018c3efec5c69f49280ca7d","https://git.kernel.org/stable/c/1b95382da85cff3bf0f922ff0275f186abdadfce","https://git.kernel.org/stable/c/2b80707b9e27671e10840d17c6f8f774c4ad9847","https://git.kernel.org/stable/c/004f7232e49730448f91665e76bdd7dff8e0c638","https://git.kernel.org/stable/c/f0ece16ffca7384787b692431961ce202907acf5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74605","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74605","identifiers":["CVE-2026-74605"]},"retained":false,"historicalAffected":[]}],"coverage":[]}