CVE-2026-46242: Linux Kernel Eventpoll Use-After-Free Privilege Escalation

Technical summary

CVE-2026-46242 is a use-after-free (UAF) vulnerability in the Linux kernel's ep_remove() function within the eventpoll implementation. The vulnerability arises from a time-of-check-time-of-use (TOCTOU) race between ep_remove() clearing file->f_ep under file->f_lock and concurrent __fput() execution. When epoll watches another epoll file descriptor (nested epoll), the race can cause hlist_del_rcu() to write into freed memory belonging to a struct eventpoll that was deallocated by ep_free(). Additionally, because struct file is SLAB_TYPESAFE_BY_RCU, the file slot may be recycled and reinitialized while ep_remove() still holds what it believes to be a valid lock, creating a kmem_cache mismatch. The fix involves pinning the file via epi_fget() before entering the critical section, ensuring __fput() cannot proceed and that the watched eventpoll remains alive during hlist_del_rcu().

Business impact

This vulnerability poses a significant risk to production Linux systems. A local attacker can exploit this flaw to corrupt kernel memory, potentially leading to privilege escalation from an unprivileged user to root, or triggering kernel panics that cause denial of service. Multi-tenant systems (containers, VMs) and systems where unprivileged users have local access are at particular risk. The impact extends beyond single-instance attacks; repeated exploitation could destabilize system stability and reliability.

Affected systems

The vulnerability affects the Linux kernel. Organizations running Linux systems with local user access should prioritize assessment. Vulnerable versions span a range of recent kernels before the fix was applied; verification against vendor advisories (distribution-specific kernel updates from Red Hat, Ubuntu, Debian, SUSE, etc.) is essential to identify exact affected kernel versions in your environment. Container and Kubernetes environments are particularly relevant since they often grant unprivileged local access.

Exploitability

This vulnerability requires local access and unprivileged user-level code execution, with no user interaction required. An attacker must be able to run arbitrary code on the system (or have shell access). The race condition can be reliably triggered through crafted epoll operations, particularly nested epoll scenarios. While exploitation is not trivial and may require tuning to race conditions on specific kernel configurations, the barrier to entry is moderate for someone with kernel internals knowledge. Public exploit code may emerge once patches are widely deployed.

Remediation

Apply kernel security updates from your Linux distribution vendor immediately. This is a kernel-level fix that requires either a reboot (for most distributions) or live kernel patching if your environment supports it. Verify patch availability from: Red Hat Enterprise Linux, Ubuntu Security Notices, Debian Security Advisories, and other distribution channels. As an interim control, restrict local shell access and consider disabling unprivileged epoll operations via seccomp filters if your workloads permit, though this is not a substitute for patching.

Patch guidance

Obtain the latest kernel update from your distribution's security channel. For RHEL, check errata advisories; for Ubuntu, consult security.ubuntu.com; for Debian, review security.debian.org. The upstream Linux kernel fix involves modifications to fs/eventpoll.c, specifically the ep_remove() function to implement file pinning via epi_fget(). Coordinate kernel updates with your change management process, schedule downtime if live patching is unavailable, and validate that dependent services remain stable post-update. Verify the exact kernel version strings match the vendor advisory recommendations for your system.

Detection guidance

Host-based detection is challenging because the vulnerability manifests as in-kernel race condition behavior. Endpoint detection should focus on: (1) monitoring for kernel panic logs or BUG messages related to eventpoll or slab corruption, (2) tracking privilege escalation events or unexpected root-level process spawning from unprivileged user sessions, (3) auditing unexpected epoll_ctl() and nested epoll() syscall patterns that might indicate exploitation attempts. Network-based detection is ineffective. Consider kernel audit rules (auditctl) to log suspicious epoll activity. Post-patch, baseline your kernel version against approved versions to catch downgrade attacks.

Why prioritize this

This vulnerability scores HIGH (7.8 CVSS) due to local attack vector with low complexity, no privileges required, and high impact across confidentiality, integrity, and availability. The use-after-free nature and potential for privilege escalation make this a critical priority for systems with unprivileged local access. Even in restricted environments, kernel stability is fundamental. This should be patched ahead of lower-severity vulnerabilities and scheduled as an emergency update in most contexts.

Risk score, explained

The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score reflects: local attack vector (AV:L) requiring presence on the machine, low attack complexity (AC:L) indicating reliable triggering, low privileges (PR:L) needing only a standard user, no user interaction required (UI:N), and high impact on confidentiality, integrity, and availability. While not a network-accessible remote code execution, the local privilege escalation potential and memory corruption severity justify the HIGH rating. The vulnerability is particularly concerning because it affects core kernel functionality (eventpoll) relied upon by many applications.

Frequently asked questions