CVE-2026-46106

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Hold eventfs_mutex and SRCU when remount walks events

Commit 340f0c7067a9 ("eventfs: Update all the eventfs_inodes from the

events descriptor") had eventfs_set_attrs() recurse through ei->children

on remount. The walk only holds the rcu_read_lock() taken by

tracefs_apply_options() over tracefs_inodes, which is wrong:

- list_for_each_entry over ei->children races with the list_del_rcu()

in eventfs_remove_rec() -- LIST_POISON1 deref, same shape as

d2603279c7d6.

- eventfs_inodes are freed via call_srcu(&eventfs_srcu, ...).

rcu_read_lock() does not extend an SRCU grace period, so ti->private

can be reclaimed under the walk.

- The writes to ei->attr race with eventfs_set_attr(), which holds

eventfs_mutex.

Reproducer:

while :; do mount -o remount,uid=$((RANDOM%1000)) /sys/kernel/tracing; done &

while :; do

echo "p:kp submit_bio" > /sys/kernel/tracing/kprobe_events

echo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References