CVE-2026-74606: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74606 Overview

CVE-2026-74606 is a use-after-free vulnerability in the Linux kernel's eventfs subsystem, specifically within the eventfs_remove_rec() function. The flaw stems from unsafe list traversal during recursive removal of child entries. When free_ei() drops the final reference on a child, release_ei() reuses the list/RCU union to queue an SRCU callback, allowing the child to be freed before the next iteration reads list.next.

The vulnerability requires local access with low privileges and can lead to memory corruption impacting confidentiality, integrity, and availability. The kernel maintainers resolved the issue by switching to list_for_each_entry_safe() to save the next sibling before recursion.

Critical Impact
A local, low-privileged attacker can trigger a use-after-free condition in the Linux kernel eventfs subsystem, potentially escalating privileges or destabilizing the host.

Affected Products

Linux kernel (upstream) — versions containing the eventfs_remove_rec() recursive traversal logic prior to the fix
Stable kernel branches referenced by commits 5635211, 74bb1ea, b77581b, f161d78, and fd73b69
Downstream Linux distributions shipping affected stable kernel releases

Discovery Timeline

2026-08-22 - CVE-2026-74606 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74606

Vulnerability Analysis

The eventfs subsystem exposes tracing events through a virtual filesystem interface. The eventfs_remove_rec() function recursively removes child entries at the current loop position. The original implementation used list_for_each_entry(), which advances the loop by reading list.next from the current entry after the loop body completes.

Inside the recursive call, free_ei() may drop the final reference on the child. When that occurs, release_ei() reuses the list/rcu union to queue a Sleepable RCU (SRCU) callback for deferred freeing. The child object can therefore be freed while the parent loop still holds a stale pointer to it.

When control returns from recursion, list_for_each_entry() dereferences the freed child's list.next to advance. This constitutes a classic use-after-free [CWE-416] on a kernel-resident object.

Root Cause

The eventfs_mutex serializes list mutations but does not extend the lifetime of the removed child. It also does not block the SRCU callback from executing. Iteration state stored in the child structure becomes invalid once the SRCU grace period releases the memory, yet the iterator continues to rely on it.

Attack Vector

Exploitation requires local access and the ability to trigger event removal paths in tracefs/eventfs. An attacker with permissions to create and delete tracing event directories can race the recursive removal against the SRCU reclaim to corrupt kernel memory. Successful exploitation can yield arbitrary kernel read/write primitives leading to local privilege escalation.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream fix in Kernel Commit 5635211 and the related stable backports for implementation details.

Detection Methods for CVE-2026-74606

Indicators of Compromise

Unexpected kernel oops or panic entries referencing eventfs_remove_rec, free_ei, or release_ei in dmesg and /var/log/kern.log.
KASAN reports flagging use-after-free reads on eventfs_inode structures during tracefs teardown.
Unusual privilege escalation activity originating from processes with access to /sys/kernel/tracing or /sys/kernel/debug/tracing.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test and staging kernels to surface use-after-free access patterns in eventfs.
Audit local users and services capable of mounting or writing to tracefs and correlate with kernel fault telemetry.
Monitor for unexpected loading or unloading of tracing subsystems that manipulate eventfs entries.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on crash signatures involving eventfs symbols.
Track processes invoking mount, unshare, or tracefs operations from non-administrative contexts.
Alert on abrupt reboots or kernel panics on production Linux hosts pending patch deployment.

How to Mitigate CVE-2026-74606

Immediate Actions Required

Apply the upstream stable kernel updates that replace list_for_each_entry() with list_for_each_entry_safe() in eventfs_remove_rec().
Inventory Linux hosts running affected stable kernel branches and prioritize multi-tenant systems and shared build hosts.
Restrict access to tracefs and debugfs mounts to trusted administrators only.

Patch Information

The fix is delivered via upstream kernel commits 5635211, 74bb1ea, b77581b, f161d78, and fd73b69. Consult your Linux distribution's security advisories to identify the corresponding backported package versions and apply them via the standard package manager.

Workarounds

Unmount tracefs where tracing is not required: umount /sys/kernel/tracing.
Tighten permissions on tracing directories so only root can traverse them, reducing the local attack surface.
Where feasible, disable CONFIG_EVENT_TRACING in custom-built kernels until patches are applied.

bash

# Restrict tracefs access until patched kernel is deployed
chmod 700 /sys/kernel/tracing
chmod 700 /sys/kernel/debug/tracing 2>/dev/null

# Verify running kernel version against distro advisory
uname -r