CVE-2026-43074

A flaw was found in the Linux kernel's eventpoll component. In certain situations, the ep_free() function in eventpoll.c can prematurely free the eventpoll data structure while it is still being used by another concurrent thread. This use-after-free (UAF) vulnerability could allow a local attacker to cause a denial of service or potentially escalate privileges.

A moderate use-after-free flaw was found in the Linux kernel's eventpoll (epoll) implementation. In certain situations, the ep_free() function in eventpoll.c can kfree() the struct eventpoll (epi->ep) while it is still being used by another concurrent thread, such as during an RCU read-side traversal, resulting in a kernel use-after-free. A local attacker able to execute code on the system could race epoll teardown against concurrent epoll operations to trigger this flaw, causing a denial of service (kernel crash) or potentially escalating privileges through memory corruption. The vulnerable epoll code was introduced in Red Hat Enterprise Linux 9.3, so RHEL 9 (9.3 and later) and RHEL 10 are affected, along with kpatch live-patched kernels and Red Hat In-Vehicle OS 2; RHEL 6, RHEL 7, RHEL 8, and the RHEL 9.0/9.2 streams are not affected because the vulnerable code is not present. This flaw is a sibling of CVE-2026-46242 (the "Bad Epoll" issue); both are race conditions introduced by the same upstream commit, and systems patched for only one of them remain vulnerable to the same class of attack. The flaw is tracked as actively exploited under CISA KEV. Fixes are being pursued through the affected product streams, and updates have already shipped for several of them. Red Hat assessed the impact as moderate with a CVSS 3.1 score of 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H), slightly below the upstream CVE.org score of 7.8 due to a lower assessed integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updated kernel packages that fix this issue have been released for several affected Red Hat Enterprise Linux streams; users should install the available kernel updates for their supported versions and reboot the system.