SECUFOCUSNOW
Home›CVE index›CVE-2026-46242
Review reviewHigh

CVE-2026-46242

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -...

CVSS
7.8
EPSS
3.23%
87.0% percentile
CISA KEV
Not listed
Published
2026.05.30
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability3.23%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= a1f93804449d13f97dabd4b996817de4bf1ed67a < 3e1144d2515d28e4312e663ea05eac203101491d, >= 58c9b016e12855286370dfb704c08498edbc857a < 2de4db145b2992da496fea6c51f9839be678ae24, >= 58c9b016e12855286370dfb704c08498edbc857a < 9324de74a3a59b9fde9b62ee45ebaa71458ba2e5, >= 58c9b016e12855286370dfb704c08498edbc857a < ef4ca02e95363e78977ca04340d44fe3b4b2b81f, >= 58c9b016e12855286370dfb704c08498edbc857a < ced39b6a8062bac5c18a1c3df85634107eb8664a, >= 58c9b016e12855286370dfb704c08498edbc857a < a6dc643c69311677c574a0f17a3f4d66a5f3744b, >= f2451def095c1743adcfcb0cb5dadc86034e162a, >= 6.1.175 < 6.1.178, >= 5.15.209 < 5.16, >= 6.4, >= 6.1.175 < 6.2, >= 6.4 < 6.18.33, >= 6.19 < 7.0.10
Fixed versions
5.16, 6.2, 6.18.33, 7.0.10

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416