Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree() to an RCU callback to prevent UAF.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026050601-CVE-2026-43074-ac01@gregkh/T
This issue has been addressed in the following products: NVIDIA for RHEL 10 Via RHSA-2026:36186 https://access.redhat.com/errata/RHSA-2026:36186
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:36541 https://access.redhat.com/errata/RHSA-2026:36541
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:36645 https://access.redhat.com/errata/RHSA-2026:36645
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:37729 https://access.redhat.com/errata/RHSA-2026:37729
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:38902 https://access.redhat.com/errata/RHSA-2026:38902
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:39371 https://access.redhat.com/errata/RHSA-2026:39371
Additional exploitability information: A working local privilege escalation exploit for CVE-2026-43074 has been published. The repository describes a use-after-free in the Linux eventpoll loop-depth check and demonstrates privilege escalation from a low-privileged local process to root/kernel privileges. The current exploit is target-specific and was tested on a Pixel 10 Pro running an Android 17 kernel based on Linux 6.6.118. The author reports a success rate greater than 80% and states that running the supplied binary twice provides a root shell. Although the published exploit is currently specific to this Pixel kernel build and AArch64 environment, the underlying vulnerability is in the Linux eventpoll implementation rather than an Android-specific component. Could you please reassess the exploitability and severity for the affected RHEL products? https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Ndays/Android-CVE-2026-43074 Upstream fix: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=07712db80857d5d09ae08f3df85a708ecfc3b61f