Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-43074

eventpoll: defer struct eventpoll free to RCU grace period

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 6.6.136, 6.12.83, 6.18.24, 6.19.14
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree() to an RCU callback to prevent UAF.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From f2451def095c1743adcfcb0cb5dadc86034e162a · fixed in 902120be4f44947df6311002addc7faf69bdbff1; From a1f93804449d13f97dabd4b996817de4bf1ed67a · fixed in a6d57084372161f86660bc4607784420e00efe2c; From 58c9b016e12855286370dfb704c08498edbc857a · fixed in a6566cd33f6f967a7651ebf2ce0dd31572e319cf; From 58c9b016e12855286370dfb704c08498edbc857a · fixed in 5b1173b165421561db29f30afc7e97d940a398a9; From 58c9b016e12855286370dfb704c08498edbc857a · fixed in 7e8083f5eeedab0f460063b9c2c14c9a4e71a427; From 58c9b016e12855286370dfb704c08498edbc857a · fixed in ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322; From 58c9b016e12855286370dfb704c08498edbc857a · fixed in 07712db80857d5d09ae08f3df85a708ecfc3b61f

  • Linux Linux

    6.4

  • KernelLinux

    From 6.4.0 · fixed in 6.6.136; From 6.7.0 · fixed in 6.12.83; From 6.13.0 · fixed in 6.18.24; From 6.19.0 · fixed in 6.19.14

References 7

git.kernel.org