CVE-2026-46242

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

eventpoll: fix ep_remove struct eventpoll / struct file UAF

ep_remove() (via ep_remove_file()) cleared file->f_ep under

file->f_lock but then kept using @file inside the critical section

(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).

A concurrent __fput() taking the eventpoll_release() fastpath in

that window observed the transient NULL, skipped

eventpoll_release_file() and ran to f_op->release / file_free().

For the epoll-watches-epoll case, f_op->release is

ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which

kfree()s the watched struct eventpoll. Its embedded ->refs

hlist_head is exactly where epi->fllink.pprev points, so the

subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed

kmalloc-192 memory.

In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot

backing @file could be recycled by alloc_empty_file() --

reinitializing f_lock and f_ep -- while ep_remove() is

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References