CVE-2026-74605

A flaw was found in the Linux kernel's eventfs component. This vulnerability allows a local attacker to cause a system crash or other unpredictable behavior due to a race condition during the freeing of an eventfs inode. The issue stems from improper synchronization when iterating over a specific internal list, which can lead to reading corrupted memory.

A MODERATE severity flaw was found in the Linux kernel eventfs component, which is used by tracefs, affecting Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. When an eventfs inode is freed, its list field is reused as an RCU list head; because the SRCU-protected iteration over that list does not take the eventfs_mutex, a concurrent iteration can read the reused pointer and follow corrupted or freed memory. A local attacker who can trigger eventfs inode freeing and directory iteration concurrently could exploit this race condition to crash the kernel or cause other unpredictable behavior, resulting in denial of service. Red Hat Enterprise Linux 6, 7, 8, and 9 update streams are not affected because the vulnerable code is not present in those kernels. For the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 streams the fix is currently deferred, as this availability-only flaw is difficult to trigger reliably (it requires winning a narrow timing race with local access to tracing); the residual risk is limited to local denial of service. Red Hat rates this flaw MODERATE with CVSS 3.1 score 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream 7.8 rating, because the demonstrated impact is a kernel crash with no evidence of impact on confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.