CVE-2026-74606

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

eventfs_remove_rec() is only reached via eventfs_remove_dir()/eventfs_remove_events_dir() during tracefs event teardown (instance rmdir, dynamic event removal, module unload); tracefs is a local pseudo-fs under /sys/kernel/tracing with no network, adjacent, or physical entry path.

AC:LAttack complexity, low

The UAF is deterministic whenever a parent eventfs_inode has 2+ children: after recursively freeing the first child, list_for_each_entry() reads list.next from repurposed freed memory; an attacker can create multiple trace events then trigger parent teardown without uncontrollable races.

PR:LPrivileges required, low

Exploitation needs local tracefs write (kprobe_events/dynamic_events to create events, rmdir on tracing instances); paths check LOCKDOWN_TRACEFS and DAC without capable(), and tracing-group gid mounts on Android/ChromeOS/dev systems commonly grant this to unprivileged users.

UI:NUser interaction, none

The attacker performs all tracefs operations to create multiple eventfs children and invoke teardown in their own session; no separate victim mount, click, or configuration action is required beyond tracefs already being accessible.

S:UScope, unchanged

The UAF corrupts kernel heap within the tracing/eventfs subsystem on the same host; it enables local privilege escalation but does not cross VM, IOMMU, container, or other security boundaries to a different authority.

C:HConfidentiality impact, high

After free_ei(), release_ei() reuses the child's list/rcu union for SRCU teardown; list_for_each_entry() then reads list.next from freed/repurposed eventfs_inode memory, a standard kernel UAF read and information-disclosure primitive.

I:HIntegrity impact, high

Freed eventfs_inode slabs can be attacker-influenced via repeated trace-event create/delete; the corrupt sibling traversal enables heap grooming for arbitrary kernel writes and local privilege escalation, not merely a bounded crash.

A:HAvailability impact, high

Reading list.next from a freed/repurposed eventfs_inode during recursive removal reliably causes invalid pointer dereferences, kernel oops, or panic; the fault is retriggerable by repeating trace-event setup and teardown cycles.