UBUNTU-CVE-2026-74606: Use After Free
In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfsremoverec() eventfsremoverec() recursively removes the child at the current loop position. After the recursive call returns, listforeachentry() advances by reading list.next from the removed child. If freeei() drops the final reference, releaseei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfsmutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running. Use listforeachentrysafe() to save the next sibling before recursively removing the current child.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In Linux kernel eventfs_remove_rec(), use list_for_each_entry_safe() to save the next sibling before recursively removing the current child.
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What could a successful exploit allow?
The issue is rated high severity with high impact to confidentiality, integrity, and availability. It is a use-after-free condition in eventfs removal handling.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
Are fixed package versions available in the provided information?
No fixed package versions are provided. The vulnerability description states that the Linux kernel issue has been resolved.