{"apiVersion":"1.0","identifier":"CVE-2026-74606","description":"In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfs_remove_rec() eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running. Use list_for_each_entry_safe() to save the next sibling before recursively removing the current child.","publishedAt":"2026-08-22T16:16:33","lastModifiedAt":"2026-08-25T06:18:37","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74606","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00125,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74606","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74606","en":"https://www.redsauce.net/en/cves/CVE-2026-74606","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74606","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74606","de":"https://www.redsauce.net/de/cves/CVE-2026-74606","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74606","el":"https://www.redsauce.net/el/cves/CVE-2026-74606"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74606"}}