CVE-2026-46242

{"id": "CVE-2026-46242", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a1f93804449d13f97dabd4b996817de4bf1ed67a", "lessThan": "3e1144d2515d28e4312e663ea05eac203101491d", "versionType": "git"}, {"status": "affected", "version": "58c9b016e12855286370dfb704c08498edbc857a", "lessThan": "2de4db145b2992da496fea6c51f9839be678ae24", "versionType": "git"}, {"status": "affected", "version": "58c9b016e12855286370dfb704c08498edbc857a", "lessThan": "9324de74a3a59b9fde9b62ee45ebaa71458ba2e5", "versionType": "git"}, {"status": "affected", "version": "58c9b016e12855286370dfb704c08498edbc857a", "lessThan": "ef4ca02e95363e78977ca04340d44fe3b4b2b81f", "versionType": "git"}, {"status": "affected", "version": "58c9b016e12855286370dfb704c08498edbc857a", "lessThan": "ced39b6a8062bac5c18a1c3df85634107eb8664a", "versionType": "git"}, {"status": "affected", "version": "58c9b016e12855286370dfb704c08498edbc857a", "lessThan": "a6dc643c69311677c574a0f17a3f4d66a5f3744b", "versionType": "git"}, {"status": "affected", "version": "f2451def095c1743adcfcb0cb5dadc86034e162a", "versionType": "git"}, {"status": "affected", "version": "6.1.175", "lessThan": "6.1.178", "versionType": "semver"}, {"status": "affected", "version": "5.15.209", "lessThan": "5.16", "versionType": "semver"}], "programFiles": ["fs/eventpoll.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"status": "unaffected", "version": "0", "lessThan": "6.4", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.144", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.95", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.33", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.10", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/eventpoll.c"], "defaultStatus": "affected"}]}], "published": "2026-05-30T13:16:21.980", "references": [{"url": "https://git.kernel.org/stable/c/2de4db145b2992da496fea6c51f9839be678ae24", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3e1144d2515d28e4312e663ea05eac203101491d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9324de74a3a59b9fde9b62ee45ebaa71458ba2e5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a6dc643c69311677c574a0f17a3f4d66a5f3744b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ced39b6a8062bac5c18a1c3df85634107eb8664a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ef4ca02e95363e78977ca04340d44fe3b4b2b81f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/08/14", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: fix ep_remove struct eventpoll / struct file UAF\n\nep_remove() (via ep_remove_file()) cleared file->f_ep under\nfile->f_lock but then kept using @file inside the critical section\n(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).\nA concurrent __fput() taking the eventpoll_release() fastpath in\nthat window observed the transient NULL, skipped\neventpoll_release_file() and ran to f_op->release / file_free().\n\nFor the epoll-watches-epoll case, f_op->release is\nep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which\nkfree()s the watched struct eventpoll. Its embedded ->refs\nhlist_head is exactly where epi->fllink.pprev points, so the\nsubsequent hlist_del_rcu()'s \"*pprev = next\" scribbles into freed\nkmalloc-192 memory.\n\nIn addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot\nbacking @file could be recycled by alloc_empty_file() --\nreinitializing f_lock and f_ep -- while ep_remove() is still\nnominally inside that lock. The upshot is an attacker-controllable\nkmem_cache_free() against the wrong slab cache.\n\nPin @file via epi_fget() at the top of ep_remove() and gate the\ncritical section on the pin succeeding. With the pin held @file\ncannot reach refcount zero, which holds __fput() off and\ntransitively keeps the watched struct eventpoll alive across the\nhlist_del_rcu() and the f_lock use, closing both UAFs.\n\nIf the pin fails @file has already reached refcount zero and its\n__fput() is in flight. Because we bailed before clearing f_ep,\nthat path takes the eventpoll_release() slow path into\neventpoll_release_file() and blocks on ep->mtx until the waiter\nside's ep_clear_and_put() drops it. The bailed epi's share of\nep->refcount stays intact, so the trailing ep_refcount_dec_and_test()\nin ep_clear_and_put() cannot free the eventpoll out from under\neventpoll_release_file(); the orphaned epi is then cleaned up\nthere.\n\nA successful pin also proves we are not racing\neventpoll_release_file() on this epi, so drop the now-redundant\nre-check of epi->dying under f_lock. The cheap lockless\nREAD_ONCE(epi->dying) fast-path bailout stays."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\neventpoll: correcci\u00f3n de UAF de struct eventpoll / struct file en ep_remove\n\nep_remove() (a trav\u00e9s de ep_remove_file()) limpi\u00f3 file->f_ep bajo file->f_lock pero luego sigui\u00f3 usando @file dentro de la secci\u00f3n cr\u00edtica (is_file_epoll(), hlist_del_rcu() a trav\u00e9s del encabezado, spin_unlock). Un __fput() concurrente que tomaba la ruta r\u00e1pida de eventpoll_release() en esa ventana observ\u00f3 el NULL transitorio, omiti\u00f3 eventpoll_release_file() y se ejecut\u00f3 a f_op->release / file_free().\n\nPara el caso de epoll-observa-epoll, f_op->release es ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), que libera con kfree() la struct eventpoll observada. Su hlist_head ->refs incrustada es exactamente donde apunta epi->fllink.pprev, por lo que el \"*pprev = next\" del hlist_del_rcu() subsiguiente escribe en memoria kmalloc-192 liberada.\n\nAdem\u00e1s, struct file es SLAB_TYPESAFE_BY_RCU, por lo que el slot que respalda a @file podr\u00eda ser reciclado por alloc_empty_file() -- reinicializando f_lock y f_ep -- mientras ep_remove() todav\u00eda est\u00e1 nominalmente dentro de ese bloqueo. El resultado es un kmem_cache_free() controlable por un atacante contra la cach\u00e9 de slab incorrecta.\n\nFija @file a trav\u00e9s de epi_fget() al inicio de ep_remove() y condiciona la secci\u00f3n cr\u00edtica al \u00e9xito de la fijaci\u00f3n. Con la fijaci\u00f3n mantenida, @file no puede alcanzar un recuento de referencias de cero, lo que evita que __fput() se ejecute y mantiene transitivamente viva la struct eventpoll observada a trav\u00e9s del hlist_del_rcu() y el uso de f_lock, cerrando ambas UAFs.\n\nSi la fijaci\u00f3n falla, @file ya ha alcanzado un recuento de referencias de cero y su __fput() est\u00e1 en curso. Debido a que abortamos antes de limpiar f_ep, esa ruta toma la ruta lenta de eventpoll_release() hacia eventpoll_release_file() y se bloquea en ep->mtx hasta que el ep_clear_and_put() del lado del esperador lo suelta. La parte de ep->refcount del epi abortado permanece intacta, por lo que el ep_refcount_dec_and_test() final en ep_clear_and_put() no puede liberar el eventpoll por debajo de eventpoll_release_file(); el epi hu\u00e9rfano es entonces limpiado all\u00ed.\n\nUna fijaci\u00f3n exitosa tambi\u00e9n prueba que no estamos compitiendo con eventpoll_release_file() en este epi, por lo que se elimina la ahora redundante nueva verificaci\u00f3n de epi->dying bajo f_lock. La salida r\u00e1pida barata sin bloqueo de READ_ONCE(epi->dying) permanece."}], "lastModified": "2026-07-24T15:17:22.733", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA466B5F-044E-47F0-A6CE-AB474F8A9361", "versionEndExcluding": "5.16", "versionStartIncluding": "5.15.209"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67892698-2698-487E-B4D2-EFCD2D933D19", "versionEndExcluding": "6.2", "versionStartIncluding": "6.1.175"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51601BBF-BF40-48AF-8132-2582D7E56D71", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}