CVE-2026-46242 Linux CVE debrief

Who should care

Linux kernel maintainers, cloud providers running multi-tenant workloads, container platform operators, and organizations with systems using nested epoll patterns or exposing epoll-based services to untrusted code.

Technical summary

The vulnerability is a race condition in the Linux kernel's eventpoll subsystem, specifically in ep_remove() and ep_remove_file(). The function clears file->f_ep under file->f_lock but continues using the @file pointer within the critical section. A concurrent __fput() taking the eventpoll_release() fastpath can observe a transient NULL in file->f_ep, skip eventpoll_release_file(), and proceed to f_op->release and file_free(). For nested epoll (epoll watching epoll), this triggers ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the struct eventpoll. The embedded ->refs hlist_head is then targeted by a subsequent hlist_del_rcu() operation, causing a write to freed kmalloc-192 memory. Additionally, because struct file is SLAB_TYPESAFE_BY_RCU, the backing memory can be recycled by alloc_empty_file() while ep_remove() still holds the lock, leading to potential kmem_cache_free() against the wrong slab cache. The fix adds epi_fget() to pin the struct file reference at the start of ep_remove(), ensuring __fput() cannot complete and the struct eventpoll remains alive through the critical section. If pinning fails, the file has already reached refcount zero and the slow path through eventpoll_release_file() handles cleanup safely.

Defensive priority

high

Recommended defensive actions

• Apply the referenced stable kernel commits as soon as available for your distribution.
• Prioritize patching systems that use nested epoll configurations or untrusted workloads with epoll.
• Monitor for stable kernel updates from your Linux distribution containing the fix commits.
• Consider enabling kernel livepatching if available to apply fixes without reboot on critical systems.
• Review application architectures that rely on epoll-watches-epoll patterns for potential exposure.

Evidence notes

The vulnerability description was published 2026-05-30 and modified 2026-06-01. The fix involves adding epi_fget() at the top of ep_remove() to pin the struct file reference, gating the critical section on successful pinning. This prevents __fput() from proceeding while the file is in use, which transitively keeps the watched struct eventpoll alive across hlist_del_rcu() and f_lock operations. Three stable kernel commits are referenced as fixes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.