CVE-2026-46106: Linux Kernel Race Condition Vulnerability

CVE-2026-46106 Overview

CVE-2026-46106 is a race condition in the Linux kernel eventfs subsystem. The flaw occurs during a tracefs remount when eventfs_set_attrs() walks the ei->children list. The walk holds only rcu_read_lock(), which is insufficient because eventfs_inodes are freed via call_srcu(&eventfs_srcu, ...) and the list is modified under eventfs_mutex. Concurrent remount and tracing operations can race with list_del_rcu() in eventfs_remove_rec() and with eventfs_set_attr() writers. The fix wraps the events portion of tracefs_apply_options() in eventfs_remount_lock()/_unlock() to acquire both eventfs_mutex and srcu_read_lock(&eventfs_srcu).

Critical Impact
A local user can trigger a use-after-free or LIST_POISON1 dereference in kernel context by racing tracefs remount with tracing event manipulation.

Affected Products

Linux kernel branches containing commit 340f0c7067a9 ("eventfs: Update all the eventfs_inodes from the events descriptor")
Stable kernel trees prior to patches 07004a8c4b57, 44e64d8a4328, 52b109f1b875, ae9cd0b46b18, and ed2ad73bcb0a
Systems exposing /sys/kernel/tracing with tracefs mounted

Discovery Timeline

2026-05-28 - CVE-2026-46106 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46106

Vulnerability Analysis

The vulnerability resides in eventfs_set_attrs(), invoked from tracefs_apply_options() during a remount of tracefs. The function recurses through ei->children to propagate inode attribute changes such as uid and gid. The original implementation protected the walk with only rcu_read_lock() held over tracefs_inodes, leaving the recursive traversal of eventfs children unsynchronized with the subsystem's actual reclamation and mutation primitives.

Three concurrent operations conflict with the remount walk. First, list_for_each_entry over ei->children races with list_del_rcu() performed by eventfs_remove_rec(), leading to dereference of LIST_POISON1. Second, eventfs_inode objects are reclaimed using call_srcu(&eventfs_srcu, ...), and rcu_read_lock() does not extend an SRCU grace period, so ti->private can be freed mid-walk. Third, writes to ei->attr collide with eventfs_set_attr(), which serializes through eventfs_mutex.

Root Cause

The root cause is incorrect locking. The walk uses the wrong synchronization primitive (rcu_read_lock()) to traverse a list whose elements are reclaimed via SRCU and whose mutations are serialized by eventfs_mutex. Commit 340f0c7067a9 introduced the recursive walk without aligning it with the established locking contract of the eventfs subsystem.

Attack Vector

The attack vector is local. An unprivileged or privileged local actor with the ability to remount tracefs and toggle trace events can trigger the race. The advisory provides a reproducer that loops mount -o remount,uid=$((RANDOM%1000)) /sys/kernel/tracing while concurrently writing to and clearing /sys/kernel/tracing/kprobe_events. The race causes the kernel to dereference poisoned list pointers or freed memory inside the remount path.

No verified public exploit code is available. The reproducer in the upstream commit message demonstrates the race condition but is intended for kernel developers validating the fix.

Detection Methods for CVE-2026-46106

Indicators of Compromise

Kernel oops or BUG: messages referencing eventfs_set_attrs, tracefs_apply_options, or list poison addresses such as LIST_POISON1
Unexpected kernel panics correlated with concurrent mount -o remount activity on /sys/kernel/tracing
Audit log entries showing repeated mount syscalls targeting tracefs from non-administrative workflows

Detection Strategies

Inventory running kernels and identify hosts whose source includes commit 340f0c7067a9 but lacks one of the listed fix commits
Monitor dmesg and journald for crash signatures involving eventfs, tracefs, or SRCU callbacks
Alert on processes invoking mount(2) with MS_REMOUNT against /sys/kernel/tracing outside of expected administrative tooling

Monitoring Recommendations

Enable KASAN and lockdep in non-production kernels to surface the use-after-free and locking-rule violations before they reach production
Forward kernel ring buffer output to a central log pipeline and apply detections for slab-use-after-free and general protection fault entries in eventfs
Track auditd syscall=mount events with /sys/kernel/tracing as the target path

How to Mitigate CVE-2026-46106

Immediate Actions Required

Apply the upstream stable kernel patches: 07004a8c4b57, 44e64d8a4328, 52b109f1b875, ae9cd0b46b18, or ed2ad73bcb0a depending on the affected branch
Restrict remount permissions on /sys/kernel/tracing to trusted administrative accounts only
Reduce exposure of tracefs in container and multi-tenant environments where untrusted workloads might trigger remounts

Patch Information

The fix wraps the events portion of tracefs_apply_options() between eventfs_remount_lock() and eventfs_remount_unlock(). These helpers acquire eventfs_mutex and srcu_read_lock(&eventfs_srcu), aligning the remount walk with the subsystem's actual synchronization contract. Because eventfs_set_attrs() does not sleep, the nested rcu_read_lock() remains valid, and lockdep_assert_held() enforces the contract at runtime. Refer to the Kernel Patch 07004a8c4b57 and the additional stable backports for distribution-specific integration.

Workarounds

Unmount tracefs on systems that do not require kernel tracing, or mount it read-only where feasible
Constrain CAP_SYS_ADMIN in container runtimes to prevent untrusted workloads from invoking mount(2) against tracefs
Avoid automation that repeatedly remounts /sys/kernel/tracing with changing uid/gid options until patches are deployed

bash

# Configuration example: restrict tracefs access pending patch deployment
mount -o remount,mode=0700 /sys/kernel/tracing
chown root:root /sys/kernel/tracing
# Verify no non-root processes can remount tracefs
auditctl -a always,exit -F arch=b64 -S mount -F path=/sys/kernel/tracing -k tracefs_mount