Riskcovery

CVE-2026-43074

eventpoll: defer struct eventpoll free to RCU grace period

State
Published
Severity
7.8 High
Published
May 6, 2026
Updated
Oct 19, 2026
Reserved
May 1, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

eventpoll: defer struct eventpoll free to RCU grace period

In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree() to an RCU callback to prevent UAF.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • f2451def095c1743adcfcb0cb5dadc86034e162a to before 902120be4f44947df6311002addc7faf69bdbff1Affected
  • a1f93804449d13f97dabd4b996817de4bf1ed67a to before a6d57084372161f86660bc4607784420e00efe2cAffected
  • 58c9b016e12855286370dfb704c08498edbc857a to before a6566cd33f6f967a7651ebf2ce0dd31572e319cfAffected
  • 58c9b016e12855286370dfb704c08498edbc857a to before 5b1173b165421561db29f30afc7e97d940a398a9Affected
  • 58c9b016e12855286370dfb704c08498edbc857a to before 7e8083f5eeedab0f460063b9c2c14c9a4e71a427Affected
  • 58c9b016e12855286370dfb704c08498edbc857a to before ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322Affected
  • 58c9b016e12855286370dfb704c08498edbc857a to before 07712db80857d5d09ae08f3df85a708ecfc3b61fAffected
LinuxLinux
  • 6.4Affected
  • before 6.4Not affected
  • 6.6.136 through 6.6.*Not affected
  • 6.12.83 through 6.12.*Not affected
  • 6.18.24 through 6.18.*Not affected
  • 6.19.14 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.