{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.88-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.7-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  eventfs: Hold eventfs_mutex and SRCU when remount walks events  Commit 340f0c7067a9 (\"eventfs: Update all the eventfs_inodes from the events descriptor\") had eventfs_set_attrs() recurse through ei-\u003echildren on remount.  The walk only holds the rcu_read_lock() taken by tracefs_apply_options() over tracefs_inodes, which is wrong:    - list_for_each_entry over ei-\u003echildren races with the list_del_rcu()     in eventfs_remove_rec() -- LIST_POISON1 deref, same shape as     d2603279c7d6.   - eventfs_inodes are freed via call_srcu(\u0026eventfs_srcu, ...).     rcu_read_lock() does not extend an SRCU grace period, so ti-\u003eprivate     can be reclaimed under the walk.   - The writes to ei-\u003eattr race with eventfs_set_attr(), which holds     eventfs_mutex.  Reproducer:    while :; do mount -o remount,uid=$((RANDOM%1000)) /sys/kernel/tracing; done \u0026   while :; do       echo \"p:kp submit_bio\" \u003e /sys/kernel/tracing/kprobe_events       echo \u003e /sys/kernel/tracing/kprobe_events   done  Wrap the events portion of tracefs_apply_options() in eventfs_remount_lock()/_unlock() that take eventfs_mutex and srcu_read_lock(\u0026eventfs_srcu).  eventfs_set_attrs() doesn't sleep so the nested rcu_read_lock() is fine; lockdep_assert_held() pins the contract.  Comment in tracefs_drop_inode() said \"RCU cycle\" -- it is SRCU.",
  "id": "DEBIAN-CVE-2026-46106",
  "modified": "2026-09-14T16:47:37.922717787Z",
  "published": "2026-05-28T10:16:25.950Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-46106"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-46106"
  ]
}