CVE-2026-46106: eventfs: Hold eventfs_mutex and SRCU when remount walks events
eventfs: Hold eventfsmutex and SRCU when remount walks events
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using the Linux kernel eventfs/tracefs infrastructure are exposed when the tracing filesystem is remounted while eventfs entries are being added and removed. The supplied reproducer performs remounts of /sys/kernel/tracing concurrently with changes to kprobe_events.
What does an attacker or local user need to do to trigger it?
The triggering activity requires local access and low privileges, matching the CVSS vector. A race can be induced by repeatedly remounting tracefs with changed mount options while concurrently creating and removing tracing events such as kprobes.
What is the impact if the race occurs?
The race can dereference a poisoned list entry or access eventfs inode data after it has been reclaimed. The reported security impact is denial of service, with no confidentiality or integrity impact indicated.
How can I identify systems potentially affected by this race?
Look for workloads or administrative automation that remount /sys/kernel/tracing, especially to change options such as uid, while tracing configuration concurrently adds or removes eventfs-backed entries. Concurrent updates to kprobe_events are specifically demonstrated as a trigger.
What change resolves the synchronization problem?
The fix wraps the events-related portion of tracefs_apply_options() with eventfs_remount_lock() and eventfs_remount_unlock(). These hold eventfs_mutex and an SRCU read lock while the remount walk accesses eventfs entries.