CVE-2026-74606

A MODERATE severity use-after-free flaw was found in the Linux kernel's eventfs implementation, which affects the Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 kernels. When eventfs_remove_rec() recursively removes child entries, the list_for_each_entry() iterator advances by reading list.next from the child that was just removed. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback, so the child may already be freed when the iterator reads the next pointer. A local attacker able to trigger eventfs removal, for example via tracefs event teardown, could exploit this race to cause memory corruption; the most realistic consequence is a kernel crash resulting in denial of service. Red Hat rates this flaw MODERATE (CVSS 5.5, availability impact only) rather than the upstream CVE.org severity of IMPORTANT (7.8) because exploitation requires local access, privileges to interact with the tracing subsystem, and winning a narrow race condition. Older Red Hat Enterprise Linux streams (RHEL 6, 7, 8, and 9) do not contain the vulnerable code and are therefore not affected. For the affected RHEL 10 and Red Hat In-Vehicle OS 2 streams the fix is currently deferred: given the local, privilege-gated, and race-dependent nature of the trigger, an out-of-cycle update was not warranted, and the residual risk is a local denial of service through a kernel crash if a user with tracefs access can trigger eventfs teardown.