CVE-2026-43074
Description
A flaw was found in the Linux kernel's eventpoll component. In certain situations, the ep_free() function in eventpoll.c can prematurely free the eventpoll data structure while it is still being used by another concurrent thread. This use-after-free (UAF) vulnerability could allow a local attacker to cause a denial of service or potentially escalate privileges.
Statement
A moderate use-after-free flaw was found in the Linux kernel's eventpoll (epoll) implementation. In certain situations, the ep_free() function in eventpoll.c can kfree() the struct eventpoll (epi->ep) while it is still being used by another concurrent thread, such as during an RCU read-side traversal, resulting in a kernel use-after-free. A local attacker able to execute code on the system could race epoll teardown against concurrent epoll operations to trigger this flaw, causing a denial of service (kernel crash) or potentially escalating privileges through memory corruption. The vulnerable epoll code was introduced in Red Hat Enterprise Linux 9.3, so RHEL 9 (9.3 and later) and RHEL 10 are affected, along with kpatch live-patched kernels and Red Hat In-Vehicle OS 2; RHEL 6, RHEL 7, RHEL 8, and the RHEL 9.0/9.2 streams are not affected because the vulnerable code is not present. This flaw is a sibling of CVE-2026-46242 (the "Bad Epoll" issue); both are race conditions introduced by the same upstream commit, and systems patched for only one of them remain vulnerable to the same class of attack. The flaw is tracked as actively exploited under CISA KEV. Fixes are being pursued through the affected product streams, and updates have already shipped for several of them. Red Hat assessed the impact as moderate with a CVSS 3.1 score of 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H), slightly below the upstream CVE.org score of 7.8 due to a lower assessed integrity impact.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updated kernel packages that fix this issue have been released for several affected Red Hat Enterprise Linux streams; users should install the available kernel updates for their supported versions and reboot the system.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.3 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
