PT-2026-45095 · Linux · Linux Kernel
CVE-2026-46242
·
Published
2026-05-30
·
Updated
2026-07-23
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions 6.4 through 6.12.67
Description
A race condition in the epoll subsystem leads to a use-after-free (UAF) scenario. The
ep remove() function (via ep remove file()) clears file->f ep under file->f lock but continues to use the @file variable within the critical section, specifically during is file epoll(), hlist del rcu(), and spin unlock(). A concurrent fput() may observe a transient NULL, skipping eventpoll release file() and proceeding to f op->release or file free(). In cases where epoll watches epoll, f op->release triggers ep eventpoll release(), ep clear and put(), and ep free(), which frees the watched struct eventpoll. This allows subsequent operations to write into freed memory. Additionally, because struct file is SLAB TYPESAFE BY RCU, the memory slot for @file could be recycled by alloc empty file(), potentially leading to an attacker-controllable kmem cache free() against an incorrect slab cache. This flaw allows an unprivileged user to escalate privileges to root. Real-world exploitation has been demonstrated with high reliability using a Return-Oriented Programming (ROP) chain to hijack CPU control.Recommendations
Update the Linux kernel to a version later than 6.12.67.
Exploit
Fix
LPE
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel