CVE-2026-74606

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the eventfs remove rec() function. The function recursively removes children at the current loop position, but list for each entry() attempts to advance by reading list.next from a child that may have already been freed. This occurs because free ei() may drop the final reference, allowing release ei() to reuse the list/rcu union for an SRCU (Sleepable Read-Copy Update) callback. While eventfs mutex serializes updates, it does not prevent the SRCU callback from running or keep the removed child alive.

Recommendations Update the Linux kernel to a version where list for each entry safe() is used within the eventfs remove rec() function to ensure the next sibling is saved before the current child is removed.