---
cve: "CVE-2026-74606"
severity: "HIGH"
cvss: 7.8
epss: "22.6%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-08-22 16:16:33"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-07T00:49:20+02:00"
---

# CVE-2026-74606

> 7.8 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Fix use-after-free in eventfs_remove_rec()

eventfs_remove_rec() recursively removes the child at the current loop
position. After the recursive call returns, list_for_each_entry() advances
by reading list.next from the removed child.

If free_ei() drops the final reference, release_ei() reuses the list/rcu
union to queue an SRCU callback. The child may be freed before that read.
The eventfs_mutex serializes list updates, but it does not keep the removed
child alive or prevent the SRCU callback from running.

Use list_for_each_entry_safe() to save the next sibling before recursively
removing the current child.

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- Kernel ≥ 6.6.152
- Kernel ≥ 6.12.104
- Kernel ≥ 6.18.45
- Kernel ≥ 7.1.9

## Referenzen

- <https://git.kernel.org/stable/c/5635211b44969f4816e29ec4d5f8665fb39535d0>
- <https://git.kernel.org/stable/c/74bb1eaf72d185a78c879eb2678ea500f82f46a8>
- <https://git.kernel.org/stable/c/b77581b25e213e83b79ce11eb30024e55ceeb3e9>
- <https://git.kernel.org/stable/c/f161d7861a0bfdf10af6b738b3b57636204661fb>
- <https://git.kernel.org/stable/c/fd73b691702170d37d66f4b0278530cea8ed419a>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-74606) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_