{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-46242 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-46242 is a high-severity use after free vulnerability in Linux kernel, published on 30 May 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-46242 and fix it if it is affected.\n\nWhat it is: CVE-2026-46242 is a high-severity use after free vulnerability in Linux kernel, published on 30 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-46242 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-46242/ (Markdown: https://insights.sbomify.com/CVE-2026-46242/index.md)","id":"CVE-2026-46242","markdown":"https://insights.sbomify.com/CVE-2026-46242/index.md","name":"CVE-2026-46242","record":{"aliases":["AZL-89159","BELL-CVE-2026-46242","DEBIAN-CVE-2026-46242","GHSA-h4r8-4j67-99mx","ROOT-OS-DEBIAN-12-CVE-2026-46242","ROOT-OS-DEBIAN-13-CVE-2026-46242","ROOT-OS-UBUNTU-2404-CVE-2026-46242","UBUNTU-CVE-2026-46242"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel's eventpoll subsystem allows attackers to execute arbitrary code or escalate privileges via race conditions.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: fix ep_remove struct eventpoll / struct file UAF\n\nep_remove() (via ep_remove_file()) cleared file-\u003ef_ep under\nfile-\u003ef_lock but then kept using @file inside the critical section\n(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).\nA concurrent __fput() taking the eventpoll_release() fastpath in\nthat window observed the transient NULL, skipped\neventpoll_release_file() and ran to f_op-\u003erelease / file_free().\n\nFor the epoll-watches-epoll case, f_op-\u003erelease is\nep_eventpoll_release() -\u003e ep_clear_and_put() -\u003e ep_free(), which\nkfree()s the watched struct eventpoll. Its embedded -\u003erefs\nhlist_head is exactly where epi-\u003efllink.pprev points, so the\nsubsequent hlist_del_rcu()'s \"*pprev = next\" scribbles into freed\nkmalloc-192 memory.\n\nIn addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot\nbacking @file could be recycled by alloc_empty_file() --\nreinitializing f_lock and f_ep -- while ep_remove() is still\nnominally inside that lock. The upshot is an attacker-controllable\nkmem_cache_free() against the wrong slab cache.\n\nPin @file via epi_fget() at the top of ep_remove() and gate the\ncritical section on the pin succeeding. With the pin held @file\ncannot reach refcount zero, which holds __fput() off and\ntransitively keeps the watched struct eventpoll alive across the\nhlist_del_rcu() and the f_lock use, closing both UAFs.\n\nIf the pin fails @file has already reached refcount zero and its\n__fput() is in flight. Because we bailed before clearing f_ep,\nthat path takes the eventpoll_release() slow path into\neventpoll_release_file() and blocks on ep-\u003emtx until the waiter\nside's ep_clear_and_put() drops it. The bailed epi's share of\nep-\u003erefcount stays intact, so the trailing ep_refcount_dec_and_test()\nin ep_clear_and_put() cannot free the eventpoll out from under\neventpoll_release_file(); the orphaned epi is then cleaned up\nthere.\n\nA successful pin also proves we are not racing\neventpoll_release_file() on this epi, so drop the now-redundant\nre-check of epi-\u003edying under f_lock. The cheap lockless\nREAD_ONCE(epi-\u003edying) fast-path bailout stays.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-07-04","github_poc":5,"max_poc_stars":21,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-07-04T16:52:30Z","kind":"github_poc","ref":"https://github.com/0xredash/CVE-2026-46242","stars":21,"title":"CVE-2026-46242"},{"date":"2026-07-11T03:26:58Z","kind":"github_poc","ref":"https://github.com/Baba01hacker666/CVE-2026-46242","stars":2,"title":"CVE-2026-46242"},{"date":"2026-07-08T00:26:26Z","kind":"github_poc","ref":"https://github.com/SaithFranklinB/ScannerBadEpoll","stars":1,"title":"Verificador de Vulnerabilidad: Bad Epoll (CVE-2026-46242)"},{"date":"2026-10-08T14:11:21Z","kind":"github_poc","ref":"https://github.com/villager1314/CVE-2026-46242-Analysis","stars":1,"title":null},{"date":"2026-08-20T01:07:58Z","kind":"github_poc","ref":"https://github.com/BinaryMasc/CVE-2026-46242","stars":0,"title":"aarch64 race condition checker"}],"tier":"poc_unverified"},"has_fix":true,"headline":"eventpoll: fix ep_remove struct eventpoll / struct file UAF","id":"CVE-2026-46242","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":7,"next":{"headline":"smb: client: reject userspace cifs.spnego descriptions","id":"CVE-2026-46243"},"packages":[],"prev":{"headline":"spi: mpc52xx: fix use-after-free on registration failure","id":"CVE-2026-46241"},"products":["Linux"],"published":"2026-05-30","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel's eventpoll subsystem allows attackers to execute arbitrary code or escalate privileges via race conditions.","url":"https://insights.sbomify.com/CVE-2026-46242/"}