CVE-2026-43074: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43074 Overview

CVE-2026-43074 is a use-after-free vulnerability in the Linux kernel's eventpoll subsystem. The flaw exists in ep_free() within eventpoll.c, where the kernel frees the epi->ep eventpoll structure while another concurrent thread still references it. The upstream fix defers the kfree() to a Read-Copy-Update (RCU) callback, ensuring the structure is only released after a grace period expires. The vulnerability affects local attackers capable of issuing epoll syscalls and racing file descriptor lifecycle operations across threads.

Critical Impact
Concurrent access to a freed eventpoll structure can lead to kernel memory corruption, information disclosure, or local privilege escalation on affected Linux systems.

Affected Products

Linux kernel (mainline) prior to the commits backporting the RCU-deferred free fix
Stable Linux kernel branches receiving the referenced backport commits
Linux distributions shipping unpatched kernels with the vulnerable eventpoll code path

Discovery Timeline

2026-05-06 - CVE-2026-43074 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43074

Vulnerability Analysis

The Linux kernel's eventpoll subsystem implements the epoll family of system calls used for scalable I/O event notification. Each epoll instance is represented by a struct eventpoll, and individual watched file descriptors are tracked via struct epitem (epi) entries that hold a back-pointer epi->ep to the parent eventpoll.

When the kernel tears down an epoll instance, ep_free() releases the struct eventpoll with kfree(). Under specific concurrent conditions, another thread can still hold or follow a reference to that structure through an epitem. The freeing thread and the accessing thread race, and the second thread dereferences memory that has already been returned to the slab allocator. This results in a classic use-after-free [CWE-416] within kernel address space.

Use-after-free conditions in the kernel are exploitable for memory disclosure or, when the freed slab is reclaimed by attacker-controlled allocations, for arbitrary write primitives leading to privilege escalation.

Root Cause

The root cause is a missing synchronization guarantee between the deallocation path in ep_free() and concurrent readers of the eventpoll structure. The original code assumed exclusive ownership at free time, but lookup paths reachable from other threads could still observe the pointer. Without an RCU grace period, the allocator could recycle the memory before all readers finished.

Attack Vector

Exploitation requires local code execution to invoke epoll_create, epoll_ctl, and close syscalls across multiple threads in a tight race window. The attacker triggers the teardown of an eventpoll instance while a parallel thread is still operating on an associated epitem, causing dereference of freed memory. The fix replaces the direct kfree() with kfree_rcu() or an equivalent call_rcu() callback so the memory is only released after a quiescent state. Refer to the upstream patches for technical details: Linux Kernel Commit 07712db8, Commit 5b1173b1, Commit 7e8083f5, Commit a6566cd3, and Commit ae0bb9c1.

Detection Methods for CVE-2026-43074

Indicators of Compromise

Kernel oops or panic logs referencing ep_free, ep_remove, or eventpoll.c with slab corruption signatures
KASAN reports identifying use-after-free reads or writes in the eventpoll subsystem
Unexpected process crashes for binaries that heavily use epoll_ctl and epoll_wait under load

Detection Strategies

Enable CONFIG_KASAN on test or canary hosts to surface use-after-free events in eventpoll paths
Monitor kernel ring buffer (dmesg) for slab-out-of-bounds and UAF traces involving epitem or eventpoll structures
Audit installed kernel package versions against distribution advisories that backport the referenced upstream commits

Monitoring Recommendations

Collect and centralize kernel logs from all Linux endpoints and servers for retroactive search of eventpoll UAF signatures
Track local processes spawning high-frequency epoll_create1 followed by rapid teardown, which can indicate race exploitation attempts
Alert on unexpected kernel module loads or privilege transitions following kernel crash events

How to Mitigate CVE-2026-43074

Immediate Actions Required

Inventory all Linux hosts and identify kernels that do not contain the RCU-deferred free fix for struct eventpoll
Apply vendor-supplied kernel updates from your distribution as soon as they ship the backported commits
Reboot affected systems after patching, since live kernels cannot be hot-swapped without livepatch tooling
Restrict local shell access on multi-tenant systems until patches are deployed

Patch Information

The fix defers the kfree() of struct eventpoll to an RCU callback so the memory is only released after a grace period, eliminating the race against concurrent readers. The change is distributed across the upstream commits 07712db8, 5b1173b1, 7e8083f5, a6566cd3, and ae0bb9c1 referenced in the NVD entry. Apply the kernel package from your Linux distribution that incorporates these commits.

Workarounds

No reliable workaround exists short of patching, because epoll is widely used by system services and cannot be disabled
Reduce exposure by limiting untrusted local users on shared systems and enforcing seccomp profiles that constrain syscall surface for low-trust workloads
Apply mandatory access control policies (SELinux, AppArmor) to confine processes that do not require epoll heavy multithreading

bash

# Verify the running kernel version and confirm patch application
uname -r

# Debian/Ubuntu: update and install the latest kernel package
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)

# RHEL/CentOS/Fedora: update kernel package
sudo dnf update kernel

# Reboot to load the patched kernel
sudo systemctl reboot