Bug 2467019 (CVE-2026-43074)
| Summary: | CVE-2026-43074 kernel: eventpoll: defer struct eventpoll free to RCU grace period | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | akito5623, rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the Linux kernel's `eventpoll` component. In certain situations, the `ep_free()` function in `eventpoll.c` can prematurely free the `eventpoll` data structure while it is still being used by another concurrent thread. This use-after-free (UAF) vulnerability could allow a local attacker to cause a denial of service or potentially escalate privileges.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-05-06 10:03:27 UTC
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026050601-CVE-2026-43074-ac01@gregkh/T This issue has been addressed in the following products: NVIDIA for RHEL 10 Via RHSA-2026:36186 https://access.redhat.com/errata/RHSA-2026:36186 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:36541 https://access.redhat.com/errata/RHSA-2026:36541 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:36645 https://access.redhat.com/errata/RHSA-2026:36645 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:37729 https://access.redhat.com/errata/RHSA-2026:37729 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:38902 https://access.redhat.com/errata/RHSA-2026:38902 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:39371 https://access.redhat.com/errata/RHSA-2026:39371 Additional exploitability information: A working local privilege escalation exploit for CVE-2026-43074 has been published. The repository describes a use-after-free in the Linux eventpoll loop-depth check and demonstrates privilege escalation from a low-privileged local process to root/kernel privileges. The current exploit is target-specific and was tested on a Pixel 10 Pro running an Android 17 kernel based on Linux 6.6.118. The author reports a success rate greater than 80% and states that running the supplied binary twice provides a root shell. Although the published exploit is currently specific to this Pixel kernel build and AArch64 environment, the underlying vulnerability is in the Linux eventpoll implementation rather than an Android-specific component. Could you please reassess the exploitability and severity for the affected RHEL products? https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Ndays/Android-CVE-2026-43074 Upstream fix: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=07712db80857d5d09ae08f3df85a708ecfc3b61f |