CVE-2026-74605: Linux Kernel Race Condition Vulnerability

CVE-2026-74605 Overview

CVE-2026-74605 is a race condition in the Linux kernel eventfs subsystem used by the tracing infrastructure. When an eventfs inode is freed, the kernel sets ei->is_freed and reuses the ei->list field, which is a union with the RCU list head, to add the inode to an SRCU (Sleepable Read-Copy-Update) linked list. Concurrent iteration of that list without holding eventfs_mutex can observe ei->rcu in place of ei->list, leading to reads of corrupt targets. The flaw affects local kernel operation and impacts confidentiality, integrity, and availability.

Critical Impact
A local, low-privileged user can trigger memory corruption during concurrent eventfs operations, potentially resulting in kernel information disclosure, data corruption, or a denial of service.

Affected Products

Linux kernel (mainline, versions containing the eventfs SRCU list implementation prior to the fix)
Linux kernel stable branches that received the eventfs backport
Distributions shipping affected upstream kernel versions

Discovery Timeline

2026-08-22 - CVE-2026-74605 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74605

Vulnerability Analysis

The eventfs subsystem manages virtual filesystem entries for kernel tracing events. Each eventfs_inode (ei) structure contains a list field that is defined as a union with an rcu head. When the inode is freed, the code sets ei->is_freed and then reuses that memory as an RCU list head to queue the structure for SRCU-based reclamation.

Readers iterate the same list under SRCU protection without acquiring eventfs_mutex. Because the union means ei->list and ei->rcu occupy the same memory, a concurrent reader can observe the RCU list head where it expected the intrusive list pointers. The reader then dereferences a corrupt target, producing undefined behavior.

The upstream fix moves the RCU head into the children field of the union, sets is_freed before publication, and inserts a smp_wmb() write barrier prior to adding the inode to the SRCU list. Readers execute a paired smp_rmb() at the start of iterating ei->children and re-check is_freed; if set, the loop exits before dereferencing invalid data.

Root Cause

The defect is a race condition combined with insufficient memory ordering [CWE-362, CWE-416]. The union aliasing between the list pointers and the RCU head allowed lock-free readers to observe partially updated state. No memory barriers enforced the ordering between setting is_freed and publishing the RCU list head, so SRCU readers could dereference stale or corrupted pointers.

Attack Vector

Exploitation requires local access with the ability to trigger eventfs operations, typically through the tracing filesystem under /sys/kernel/tracing or /sys/kernel/debug/tracing. An attacker races inode teardown with concurrent directory iteration to reach the corrupted-target read path.

The vulnerability manifests during concurrent SRCU list traversal. See the upstream commits Kernel Git Commit 004f7232 and Kernel Git Commit f0ece16f for the authoritative patch diffs and comments describing the barrier placement.

Detection Methods for CVE-2026-74605

Indicators of Compromise

Unexpected kernel oops or general protection fault messages referencing eventfs functions in dmesg or /var/log/kern.log.
KASAN (Kernel Address Sanitizer) reports involving eventfs_inode, list_for_each_entry_srcu, or use-after-free traces in tracefs code paths.
Unprivileged processes performing sustained parallel open, read, and unlink operations against tracefs directories.

Detection Strategies

Inventory running kernels with uname -r across the fleet and compare against distribution advisories that reference the fix commits.
Enable KASAN and lockdep on test kernels to catch races and invalid dereferences in eventfs during pre-production validation.
Audit for processes with unusual access patterns to /sys/kernel/tracing and /sys/kernel/debug/tracing.

Monitoring Recommendations

Forward kernel logs to a centralized store and alert on new eventfs-related stack traces or oops signatures.
Track kernel package versions across endpoints and servers and flag hosts running unpatched builds.
Monitor for privilege-boundary anomalies from processes that repeatedly interact with tracefs after mount.

How to Mitigate CVE-2026-74605

Immediate Actions Required

Apply vendor kernel updates that incorporate commits 004f7232 and f0ece16f as soon as they are available for your distribution.
Restrict access to /sys/kernel/tracing and /sys/kernel/debug/tracing to trusted administrative accounts by tightening mount options and directory permissions.
Reboot affected hosts after patching to ensure the fixed kernel is running.

Patch Information

The fix changes the union layout so the RCU head shares storage with the children field instead of list, and it adds smp_wmb()/smp_rmb() barriers around the is_freed flag. Reference the upstream commits Kernel Git Commit 004f7232 and Kernel Git Commit f0ece16f. Consult your distribution's security tracker to identify the specific package version containing the backport.

Workarounds

Unmount debugfs and tracefs on production systems that do not require kernel tracing, using umount /sys/kernel/debug and umount /sys/kernel/tracing.
Set restrictive permissions such as chmod 0700 on tracefs mount points so only root can access eventfs entries.
Disable interactive shell access for untrusted local users on hosts running affected kernels until patches are applied.

bash

# Restrict tracefs access as a temporary mitigation
mount -o remount,mode=0700 /sys/kernel/tracing
chmod 0700 /sys/kernel/debug
chmod 0700 /sys/kernel/tracing

# Verify the running kernel version against distribution advisories
uname -r