Linux Kernel up to 7.1.8 eventfs fs/eventfs.c smp_wmb/smp_rmb children/is_freed race condition

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.1.8. Affected by this issue is the function smp_wmb/smp_rmb of the file fs/eventfs.c of the component eventfs. Performing a manipulation of the argument children/is_freed results in race condition. This vulnerability is known as CVE-2026-74605. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.8. It has been classified as very critical. This affects the function smp_wmb/smp_rmb of the file fs/eventfs.c of the component eventfs. The manipulation of the argument children/is_freed with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: eventfs: Use children field for rcu head and add memory barriers When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list field is a union with the rcu list head. As the ei->list is used to iterate over an SRCU protected list without taking the eventfs_mutex, there's nothing stopping the iteration over that list to see the ei->rcu instead of the ei->list and it will read a corrupt target. To fix this, change the union of the rcu list head with the children list. On freeing the eventfs inode, set the is_free and execute a smp_wmb() before adding the eventfs inode to the SRCU list. On iteration of the ei->children list, at the start, execute a smp_rmb() and then read the is_freed of the ei to see if the children list is still valid. If is_freed is set, then the ei_child read is not valid and the loop should exit immediately.

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-74605 since 08/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/22/2026).

Upgrading to version 7.1.9 eliminates this vulnerability. Applying the patch 004f7232e49730448f91665e76bdd7dff8e0c638/f0ece16ffca7384787b692431961ce202907acf5 is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion