CVE-2026-74606

A flaw was found in the Linux kernel's eventfs component. The eventfs_remove_rec() function contains a use-after-free vulnerability where it attempts to access memory after it has been deallocated. This can occur during recursive removal of child entries. A local attacker could exploit this flaw to cause memory corruption, potentially leading to a denial of service or arbitrary code execution.

A MODERATE severity use-after-free flaw was found in the Linux kernel's eventfs implementation, which affects the Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 kernels. When eventfs_remove_rec() recursively removes child entries, the list_for_each_entry() iterator advances by reading list.next from the child that was just removed. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback, so the child may already be freed when the iterator reads the next pointer. A local attacker able to trigger eventfs removal, for example via tracefs event teardown, could exploit this race to cause memory corruption; the most realistic consequence is a kernel crash resulting in denial of service. Red Hat rates this flaw MODERATE (CVSS 5.5, availability impact only) rather than the upstream CVE.org severity of IMPORTANT (7.8) because exploitation requires local access, privileges to interact with the tracing subsystem, and winning a narrow race condition. Older Red Hat Enterprise Linux streams (RHEL 6, 7, 8, and 9) do not contain the vulnerable code and are therefore not affected. For the affected RHEL 10 and Red Hat In-Vehicle OS 2 streams the fix is currently deferred: given the local, privilege-gated, and race-dependent nature of the trigger, an out-of-cycle update was not warranted, and the residual risk is a local denial of service through a kernel crash if a user with tracefs access can trigger eventfs teardown.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.