EUVD-2026-64543
GHSA-qfq9-8c5m-346x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition against SRCU callback timing warrants AC:H over NVD's AC:L; PR:L is correct as tracefs access requires a local authenticated session.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
eventfs: Fix use-after-free in eventfs_remove_rec()
eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child.
If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running.
Use list_for_each_entry_safe() to save the next sibling before recursively removing the current child.
AnalysisAI
Use-after-free in the Linux kernel's eventfs subsystem allows a local low-privileged user to corrupt kernel memory by triggering unsafe iterator advancement after recursive child removal in eventfs_remove_rec(). Affected stable branches span Linux 6.6.18 through pre-6.6.152, 6.7.6 through pre-6.8, and related ranges; patched versions (6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2) are available via upstream kernel.org stable commits. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local shell on the target system with at least low-privilege user credentials, as confirmed by CVSS PR:L and AV:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 and accurately reflects local exploitation with low-privilege credentials, no user interaction, and high-impact potential across all three security properties. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local unprivileged user with read access to the tracefs filesystem triggers removal of a set of eventfs entries, causing eventfs_remove_rec() to recurse and drop the final reference on a child entry. The SRCU callback races to free or corrupt the child's memory before list_for_each_entry() reads the list.next pointer to advance iteration, producing a use-after-free read or write primitive. … |
| Remediation | The primary remediation is to upgrade to a patched kernel version: Linux 6.6.152 for the 6.6.x LTS branch, 6.12.104 for the 6.12.x branch, 6.18.45 for the 6.18.x branch, 7.1.9 for the 7.1.x branch, or 7.2 for the mainline branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux systems running affected kernel versions using uname -r and correlate against kernel releases 6.6.18-6.6.151, 6.7.6-6.7.x, and the specified vulnerable ranges; prioritize systems permitting untrusted local users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today