Linux Kernel EUVD-2026-64542

Exploitation requires a local shell with at minimum standard (low-privilege) user credentials on an affected kernel version - confirmed by CVSS PR:L. The vulnerable code path is exclusively in the eventfs/tracefs subsystem; the attacker must be able to interact with the tracefs virtual filesystem, typically mounted at /sys/kernel/tracing or /sys/kernel/debug/tracing. On many hardened Linux deployments, tracefs access is restricted to root or a dedicated 'tracing' group via mount permissions, directly limiting the exploitable user population. Beyond access, the attack requires winning a memory-ordering race between SRCU deferred-free callbacks and a concurrent list reader - a timing constraint that makes exploitation inherently probabilistic and unreliable without sustained repeated attempts. Limiting exploitation further: the vulnerability is absent from CISA KEV and has EPSS 0.20% (10th percentile), consistent with no observed in-the-wild abuse.

The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) base score signals a high-severity local kernel vulnerability, but multiple contextual signals substantially discount real-world risk. The EPSS score of 0.20% at the 10th percentile is strongly consistent with zero observed exploitation activity. The CVE is not in CISA KEV, and no POC has been identified. Critically, the attack requires precise race-window timing between SRCU deferred-free callbacks and concurrent eventfs list traversal - a non-trivial reliability constraint that the NVD-assigned AC:L does not fully capture; an independent assessment of AC:H is more representative. Exploitation is additionally gated behind local shell access and at minimum low-privilege credentials (PR:L), with practical exploitation further limited by the fact that tracefs access is often restricted to root or a tracing group on hardened production systems. The CVSS High CIA impact is theoretically sound for a kernel memory corruption primitive, but the combination of local-only vector, race-condition requirement, and near-zero EPSS places this in the 'patch on next cycle' rather than 'emergency response' category for most environments. Note: CVSS vector and affected versions are confirmed; exploitation complexity is inferred from the technical description rather than independently verified by a vendor severity advisory.

An attacker with an existing low-privileged local shell on a vulnerable Linux system repeatedly opens and closes tracefs event files to drive concurrent eventfs inode allocation and teardown. By racing the SRCU deferred-free callback against a concurrent ei->children list traversal - achievable through multi-threaded file descriptor churn - the attacker causes the kernel to dereference a list pointer overwritten by the RCU freelist head, potentially reading arbitrary kernel memory or corrupting kernel data structures in a manner exploitable for local privilege escalation. No public POC is known, making reliable exploitation a non-trivial engineering effort.