Описание
In the Linux kernel, the following vulnerability has been resolved:
eventpoll: defer struct eventpoll free to RCU grace period
In certain situations, ep_free() in eventpoll.c will kfree the epi->ep
eventpoll struct while it still being used by another concurrent thread.
Defer the kfree() to an RCU callback to prevent UAF.
A flaw was found in the Linux kernel's eventpoll component. In certain situations, the ep_free() function in eventpoll.c can prematurely free the eventpoll data structure while it is still being used by another concurrent thread. This use-after-free (UAF) vulnerability could allow a local attacker to cause a denial of service or potentially escalate privileges.
Отчет
A moderate use-after-free flaw was found in the Linux kernel's eventpoll (epoll) implementation. In certain situations, the ep_free() function in eventpoll.c can kfree() the struct eventpoll (epi->ep) while it is still being used by another concurrent thread, such as during an RCU read-side traversal, resulting in a kernel use-after-free. A local attacker able to execute code on the system could race epoll teardown against concurrent epoll operations to trigger this flaw, causing a denial of service (kernel crash) or potentially escalating privileges through memory corruption. The vulnerable epoll code was introduced in Red Hat Enterprise Linux 9.3, so RHEL 9 (9.3 and later) and RHEL 10 are affected, along with kpatch live-patched kernels and Red Hat In-Vehicle OS 2; RHEL 6, RHEL 7, RHEL 8, and the RHEL 9.0/9.2 streams are not affected because the vulnerable code is not present. This flaw is a sibling of CVE-2026-46242 (the "Bad Epoll" issue); both are race conditions introduced by the same upstream commit, and systems patched for only one of them remain vulnerable to the same class of attack. The flaw is tracked as actively exploited under CISA KEV. Fixes are being pursued through the affected product streams, and updates have already shipped for several of them. Red Hat assessed the impact as moderate with a CVSS 3.1 score of 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H), slightly below the upstream CVE.org score of 7.8 due to a lower assessed integrity impact.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updated kernel packages that fix this issue have been released for several affected Red Hat Enterprise Linux streams; users should install the available kernel updates for their supported versions and reboot the system.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| NVIDIA for RHEL 10 | kernel | Fixed | RHSA-2026:36186 | 07.07.2026 |
| NVIDIA for RHEL 10 | kernel | Fixed | RHSA-2026:73187 | 29.09.2026 |
| Red Hat Enterprise Linux 10 | kernel | Fixed | RHSA-2026:36541 | 08.07.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | kernel | Fixed | RHSA-2026:39371 | 14.07.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:36645 | 08.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree() to an RCU callback to prevent UAF.
In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree() to an RCU callback to prevent UAF.
In the Linux kernel, the following vulnerability has been resolved: e ...
In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree() to an RCU callback to prevent UAF.
Уязвимость функции ep_free() компонента eventpoll.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.3 High
CVSS3