PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-74605 Linux CVE debrief

A vulnerability in the Linux kernel's eventfs has been addressed. When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list field is a union with the rcu list head. As the ei->list is used to iterate over an SRCU protected list without taking the eventfs_mutex, there's nothing stopping the iteration over that list to see the ei->rcu instead of the ei->list and it will read a corrupt target. To fix this, change the union of the rcu list head with the children list. On freeing the eventfs inode, set the is_free and execute a smp_wmb() before adding the eventfs inode to the SRCU list. On iteration of the ei->children list, at the start, execute a smp_rmb() and then read the is_freed of the ei to see if the children list is still valid. If is_freed is set, then the ei_child read is not valid and the loop should exit immediately.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-22
Original CVE updated
2026-10-15
Advisory published
2026-08-22
Advisory updated
2026-10-15

Who should care

Linux system administrators, security teams, and developers working with the Linux kernel should assess exposure and prioritize verification and mitigation efforts. Linux system administrators and security teams should assess exposure, prioritize verification of Linux kernel versions, and apply patches or mitigations as available. Those responsible for Linux kernel maintenance, security teams, and IT administrators should review the vulnerability details.

Why it matters

This vulnerability in the Linux kernel's eventfs could lead to corruption when iterating over an SRCU protected list. Linux system administrators and security teams should assess exposure, prioritize verification of Linux kernel versions, and apply patches or mitigations as available.

  • Verify Linux kernel versions to determine exposure
  • Apply patches or mitigations to prevent potential corruption
  • Monitor system logs for suspicious activity related to eventfs
  • Review incident response plans for potential impacts

Technical summary

The Linux kernel's eventfs has a vulnerability that could lead to corruption when iterating over an SRCU protected list. The fix involves changing the union of the rcu list head with the children list and adding memory barriers. This vulnerability in the Linux kernel's eventfs could lead to corruption when iterating over an SRCU protected list without taking the eventfs_mutex. Linux system administrators and security teams should assess exposure and prioritize verification of Linux kernel versions, especially those identified as affected, and apply patches or mitigations as available.

Defensive priority

Linux system administrators and security teams should assess exposure and prioritize verification of Linux kernel versions, especially those identified as affected, and apply patches or mitigations as available.

Recommended defensive actions

  • Assess Linux kernel versions for exposure
  • Verify and apply patches or mitigations for affected systems
  • Monitor system logs for suspicious activity
  • Review and update incident response plans
  • Track exceptions and retest remediated assets
  • Review compensating controls for exposed systems
  • Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and associated source item provide details on the vulnerability and its fix in the Linux kernel. Specific affected versions are noted, and references to source code changes are provided.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-74605 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-74605

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-74605 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-74605

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • eventfs: Use children field for rcu head and add memory barriers

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74605.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2b80707b9e27671e10840d17c6f8f774c4ad9847

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/004f7232e49730448f91665e76bdd7dff8e0c638

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f0ece16ffca7384787b692431961ce202907acf5

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.