HIGH CWE-416
CVE-2026-43074
eventpoll: defer struct eventpoll free to RCU grace period
7.8/ 10
CVSS 3.1
High severity
0.48%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 42% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- May 6, 2026
- Updated
- Oct 19, 2026
- First covered
- Jul 6, 2026
- Latest story
- 4 months ago
Summary
In the Linux kernel, the following vulnerability has been resolved:eventpoll: defer struct eventpoll free to RCU grace periodIn certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree() to an RCU callback to prevent UAF.
CWE-416Use After Free
Attack profile
Attack vectorLocal
ComplexityLow
PrivilegesLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HAffected products
- Linuxf2451def095c1743adcfcb0cb5dadc86034e162a to before 902120be4f44947df6311002addc7faf69bdbff1a1f93804449d13f97dabd4b996817de4bf1ed67a to before a6d57084372161f86660bc4607784420e00efe2c58c9b016e12855286370dfb704c08498edbc857a to before a6566cd33f6f967a7651ebf2ce0dd31572e319cf58c9b016e12855286370dfb704c08498edbc857a to before 5b1173b165421561db29f30afc7e97d940a398a9
- Linux6.4