CVE-2026-46242
eventpoll: fix ep_remove struct eventpoll / struct file UAF
Description
In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.
INFO
Published Date :
May 30, 2026, 1:16 p.m.
Last Modified :
July 24, 2026, 3:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the patched version.
- Reboot the system after applying the update.
- Verify the kernel version is updated.
Public PoC/Exploit Available at Github
CVE-2026-46242 has a 24 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-46242.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-46242 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-46242
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Localroot binary exploit toolkit (xpl2026) - private mirror
Python Shell Dockerfile Makefile C Perl
Use CVE-2026-43074 to disable SELinux on Android (Linux 6.6/6.12)
Makefile C
Security Backports for the FriendlyElec CM3588 Linux Kernel, Debian 6.1.141
KVM KernelCare + Januscape (CVE-2026-53359) verification & mitigation scripts
Shell
Panduan mitigasi Januscape (CVE-2026-53359) AlmaLinux 9.5 production-safe + scripts
Shell CSS HTML Python
None
Batchfile PowerShell Shell Go
Evidence-first tracker for vulnerabilities claimed to be difficult for AI security systems to discover.
ai-security benchmark github-pages security-research vulnerability-research
JavaScript HTML CSS
CVE-2026-46242
C
Verificador de Vulnerabilidad: Bad Epoll (CVE-2026-46242)
Shell
None
Python Shell C C++ GDB TeX Mermaid
CVE-2026-46242
C
Full Weaponized LPE Toolkit 2026
exploit linux-privilege-escalation privilage-escalation rootkit toolkit
C
None
CachyOS Based Hardened Linux kernel with Rust FFI security hooks - blocks page-cache write vulnerabilities by calling Rust from C at the syscall boundary. Also we add extra optional patches.
Makefile Rust Shell C
Curated Linux LPE corpus — 28 modules from 2016 to 2026, with detection rules. One command, safest-first root: skeletonkey --auto --i-know
auditd blueteam cve detection-rules exploit-development kernel-security linux-security pentesting privilege-escalation redteam sigma
Makefile C Shell Assembly Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-46242 vulnerability anywhere in the article.
-
The Hacker News
15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
Researchers at Nebula Security have disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw that lets any logged-in user take full root control of a machine that has not been patched. Th ... Read more
-
The Hacker News
New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets an ordinary user with no special access take full control of a machine as root. It affects Linux desktops, servers, and Andro ... Read more
The following table lists the changes that have been made to the
CVE-2026-46242 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 24, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/3e1144d2515d28e4312e663ea05eac203101491d Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': '2de4db145b2992da496fea6c51f9839be678ae24', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': '9324de74a3a59b9fde9b62ee45ebaa71458ba2e5', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ef4ca02e95363e78977ca04340d44fe3b4b2b81f', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ced39b6a8062bac5c18a1c3df85634107eb8664a', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'a6dc643c69311677c574a0f17a3f4d66a5f3744b', 'versionType': 'git'}, {'status': 'affected', 'version': 'f2451def095c1743adcfcb0cb5dadc86034e162a', 'versionType': 'git'}, {'status': 'affected', 'version': 'a1f93804449d13f97dabd4b996817de4bf1ed67a', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.209', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.175', 'lessThan': '6.2', 'versionType': 'semver'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.4'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.4', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'a1f93804449d13f97dabd4b996817de4bf1ed67a', 'lessThan': '3e1144d2515d28e4312e663ea05eac203101491d', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': '2de4db145b2992da496fea6c51f9839be678ae24', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': '9324de74a3a59b9fde9b62ee45ebaa71458ba2e5', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ef4ca02e95363e78977ca04340d44fe3b4b2b81f', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ced39b6a8062bac5c18a1c3df85634107eb8664a', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'a6dc643c69311677c574a0f17a3f4d66a5f3744b', 'versionType': 'git'}, {'status': 'affected', 'version': 'f2451def095c1743adcfcb0cb5dadc86034e162a', 'versionType': 'git'}, {'status': 'affected', 'version': '6.1.175', 'lessThan': '6.1.178', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.15.209', 'lessThan': '5.16', 'versionType': 'semver'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.4'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.4', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'affected'}] -
CVE Translated by [email protected]
Jul. 22, 2026
Action Type Old Value New Value Added Translation Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: eventpoll: corrección de UAF de struct eventpoll / struct file en ep_remove ep_remove() (a través de ep_remove_file()) limpió file->f_ep bajo file->f_lock pero luego siguió usando @file dentro de la sección crítica (is_file_epoll(), hlist_del_rcu() a través del encabezado, spin_unlock). Un __fput() concurrente que tomaba la ruta rápida de eventpoll_release() en esa ventana observó el NULL transitorio, omitió eventpoll_release_file() y se ejecutó a f_op->release / file_free(). Para el caso de epoll-observa-epoll, f_op->release es ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), que libera con kfree() la struct eventpoll observada. Su hlist_head ->refs incrustada es exactamente donde apunta epi->fllink.pprev, por lo que el "*pprev = next" del hlist_del_rcu() subsiguiente escribe en memoria kmalloc-192 liberada. Además, struct file es SLAB_TYPESAFE_BY_RCU, por lo que el slot que respalda a @file podría ser reciclado por alloc_empty_file() -- reinicializando f_lock y f_ep -- mientras ep_remove() todavía está nominalmente dentro de ese bloqueo. El resultado es un kmem_cache_free() controlable por un atacante contra la caché de slab incorrecta. Fija @file a través de epi_fget() al inicio de ep_remove() y condiciona la sección crítica al éxito de la fijación. Con la fijación mantenida, @file no puede alcanzar un recuento de referencias de cero, lo que evita que __fput() se ejecute y mantiene transitivamente viva la struct eventpoll observada a través del hlist_del_rcu() y el uso de f_lock, cerrando ambas UAFs. Si la fijación falla, @file ya ha alcanzado un recuento de referencias de cero y su __fput() está en curso. Debido a que abortamos antes de limpiar f_ep, esa ruta toma la ruta lenta de eventpoll_release() hacia eventpoll_release_file() y se bloquea en ep->mtx hasta que el ep_clear_and_put() del lado del esperador lo suelta. La parte de ep->refcount del epi abortado permanece intacta, por lo que el ep_refcount_dec_and_test() final en ep_clear_and_put() no puede liberar el eventpoll por debajo de eventpoll_release_file(); el epi huérfano es entonces limpiado allí. Una fijación exitosa también prueba que no estamos compitiendo con eventpoll_release_file() en este epi, por lo que se elimina la ahora redundante nueva verificación de epi->dying bajo f_lock. La salida rápida barata sin bloqueo de READ_ONCE(epi->dying) permanece. -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Jul. 09, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/07/08/14 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 04, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/2de4db145b2992da496fea6c51f9839be678ae24 Added Reference https://git.kernel.org/stable/c/9324de74a3a59b9fde9b62ee45ebaa71458ba2e5 Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ef4ca02e95363e78977ca04340d44fe3b4b2b81f', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ced39b6a8062bac5c18a1c3df85634107eb8664a', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'a6dc643c69311677c574a0f17a3f4d66a5f3744b', 'versionType': 'git'}, {'status': 'affected', 'version': 'f2451def095c1743adcfcb0cb5dadc86034e162a', 'versionType': 'git'}, {'status': 'affected', 'version': 'a1f93804449d13f97dabd4b996817de4bf1ed67a', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.209', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.175', 'lessThan': '6.2', 'versionType': 'semver'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.4'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.4', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': '2de4db145b2992da496fea6c51f9839be678ae24', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': '9324de74a3a59b9fde9b62ee45ebaa71458ba2e5', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ef4ca02e95363e78977ca04340d44fe3b4b2b81f', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ced39b6a8062bac5c18a1c3df85634107eb8664a', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'a6dc643c69311677c574a0f17a3f4d66a5f3744b', 'versionType': 'git'}, {'status': 'affected', 'version': 'f2451def095c1743adcfcb0cb5dadc86034e162a', 'versionType': 'git'}, {'status': 'affected', 'version': 'a1f93804449d13f97dabd4b996817de4bf1ed67a', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.209', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.175', 'lessThan': '6.2', 'versionType': 'semver'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.4'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.4', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ef4ca02e95363e78977ca04340d44fe3b4b2b81f', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ced39b6a8062bac5c18a1c3df85634107eb8664a', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'a6dc643c69311677c574a0f17a3f4d66a5f3744b', 'versionType': 'git'}, {'status': 'affected', 'version': 'f2451def095c1743adcfcb0cb5dadc86034e162a', 'versionType': 'git'}, {'status': 'affected', 'version': 'a1f93804449d13f97dabd4b996817de4bf1ed67a', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.209', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.175', 'lessThan': '6.2', 'versionType': 'semver'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.4'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.4', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Jun. 10, 2026
Action Type Old Value New Value Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.209 up to (excluding) 5.16 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.175 up to (excluding) 6.2 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.4 up to (excluding) 6.18.33 Added Reference Type kernel.org: https://git.kernel.org/stable/c/a6dc643c69311677c574a0f17a3f4d66a5f3744b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ced39b6a8062bac5c18a1c3df85634107eb8664a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ef4ca02e95363e78977ca04340d44fe3b4b2b81f Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 05, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 30, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays. Added Reference https://git.kernel.org/stable/c/a6dc643c69311677c574a0f17a3f4d66a5f3744b Added Reference https://git.kernel.org/stable/c/ced39b6a8062bac5c18a1c3df85634107eb8664a Added Reference https://git.kernel.org/stable/c/ef4ca02e95363e78977ca04340d44fe3b4b2b81f