Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-46242— eventpoll: fix ep_remove struct eventpoll / struct file UAF

Quick assessment

Affected
Linux Linux
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于eventpoll中ep_remove函数在清除file->f_ep后继续使用@file，可能导致释放后重用。

CVSS 7.8 · High EPSS 4.39% · P91

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux f2451def095c1743adcfcb0cb5dadc86034e162a< a10fbbe74e1c743beb1bb312109366667461df8a affected
a1f93804449d13f97dabd4b996817de4bf1ed67a< 3e1144d2515d28e4312e663ea05eac203101491d affected
58c9b016e12855286370dfb704c08498edbc857a< 2de4db145b2992da496fea6c51f9839be678ae24 affected
58c9b016e12855286370dfb704c08498edbc857a< 9324de74a3a59b9fde9b62ee45ebaa71458ba2e5 affected
58c9b016e12855286370dfb704c08498edbc857a< ef4ca02e95363e78977ca04340d44fe3b4b2b81f affected
58c9b016e12855286370dfb704c08498edbc857a< ced39b6a8062bac5c18a1c3df85634107eb8664a affected
58c9b016e12855286370dfb704c08498edbc857a< a6dc643c69311677c574a0f17a3f4d66a5f3744b affected
5.15.209< 5.15.222 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-46242

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
eventpoll: fix ep_remove struct eventpoll / struct file UAF
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于eventpoll中ep_remove函数在清除file->f_ep后继续使用@file，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux f2451def095c1743adcfcb0cb5dadc86034e162a ~ a10fbbe74e1c743beb1bb312109366667461df8a -
Linux Linux 6.4 -

II. Public POCs for CVE-2026-46242

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
default-local-qwen3.6 · 11705 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-46242

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-46242 (7)

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-46242

No comments yet

Leave a comment