In the Linux kernel

CVE-2026-43074 is a use-after-free in the Linux kernel's fs/eventpoll.c. The function ep_free() can kfree the struct eventpoll object while another concurrent thread is still reading from it. The race was introduced by a 2023 commit family that reworked epoll's reference counting. Affected kernels include mainline 6.6+ through 7.x; older LTS branches like 6.1 and 5.10 are not affected because the vulnerable refactoring was never backported to them. The upstream fix (commit 07712db80857) replaces kfree(ep) with kfree_rcu(ep, rcu), deferring reclamation until all concurrent RCU readers have exited their critical sections. Distro fixes are available: RHEL 9.4+/10, Debian Trixie (6.12.85-1+), and Forky (7.1.7-1+).

The vendor CVSS of 7.8 HIGH is defensible. This is a local privilege escalation with low attack complexity and low privileges required — the textbook profile for a kernel UAF. Notably, Red Hat's own Bugzilla rates the *priority* as Medium, which is a pragmatic nod to the local-access prerequisite. However, a public kernelCTF exploit by Jaeyoung Chung (Seoul National University) demonstrates 80%+ success rates on 6.6.118/AArch64, and a closely related sibling bug (CVE-2026-46242, "Bad Epoll") achieves 98–99% on LTS and Container-Optimized OS. The exploit reliability and the ubiquity of the affected component keep this firmly in the HIGH bucket.

Why this verdict

• Public exploit with high reliability: Jaeyoung Chung's kernelCTF PoC achieves 80%+ success on AArch64 and the sibling Bad Epoll PoC hits 98–99% on x86_64 LTS. This is not a theoretical bug — it is a proven, weaponized LPE.
• Role multiplier: The Linux kernel is the canonical high-value component. On Kubernetes nodes (≥15–20% of enterprise Linux installs), this UAF is a container escape to root on the host, compromising every pod on that node — blast radius is tenant → fleet. On KVM hypervisors, root equals access to all guest VMs. On CI runners, root equals exfiltration of all build secrets and supply-chain pivot. The component is definitionally high-value-role (≥10% of installs), setting a verdict floor of HIGH.
• Local access prerequisite provides meaningful friction: AV:L means the attacker must already have code execution on the target. This is not remotely exploitable. Every exploitation scenario requires a prior compromise stage (phished user, compromised app, malicious container image). This friction prevents escalation to CRITICAL.
• Narrow affected version range: Only kernels 6.6+ are vulnerable. The large installed base of RHEL 8 (4.18), RHEL 9.0–9.2 (5.14), Debian Bullseye (5.10), and Bookworm (6.1) are unaffected, materially reducing the exposed population compared to a kernel bug that hits all branches.

Why not higher?

CRITICAL would require either remote exploitability or an active KEV listing / confirmed in-the-wild campaign. This bug requires local access — every attack chain must first solve the initial-access problem independently. The EPSS of 0.48% and absence from KEV corroborate that mass exploitation is not imminent. The affected version range (6.6+) also excludes a large share of enterprise kernels still on older LTS branches.

Why not lower?

A public exploit with 80%+ reliability against a universally-deployed component (the kernel) prevents any downgrade below HIGH. On Kubernetes nodes, CI runners, and KVM hypervisors — which collectively represent well over 10% of 6.6+ kernel deployments — successful exploitation yields host-level root from an unprivileged container, with blast radius extending to all co-located workloads. The role-multiplier floor holds this at HIGH regardless of the local-access friction.

1. Restrict unprivileged user namespaces — Set kernel.unprivileged_userns_clone=0 (Debian) or use the RHEL 9.4+ user-namespace restrictions. Many kernel exploits — including UAF heap sprays — rely on unprivileged user namespaces for capability escalation primitives. Deploy within the noisgate mitigation SLA of 30 days.
2. Enable seccomp-bpf profiles blocking epoll_create/epoll_ctl where unnecessary — Containers and CI workloads that do not need epoll can run under a strict seccomp profile that blocks epoll_create1, epoll_ctl, and epoll_wait. This directly eliminates the attack surface. Kubernetes PodSecurityAdmission or OPA/Gatekeeper can enforce this. Deploy within 30 days.
3. Enforce read-only root filesystems and drop all capabilities in container security contexts — Setting readOnlyRootFilesystem: true, allowPrivilegeEscalation: false, and dropping ALL capabilities in Kubernetes SecurityContext limits post-exploitation options even if the UAF fires. Deploy within 30 days.
4. Prioritize kernel patching on Kubernetes nodes, CI runners, and KVM hypervisors — These are the high-blast-radius hosts. Patch these first, within the 30-day mitigation window, even if general fleet patching takes longer. Use node cordoning and rolling replacement to minimize downtime.
5. Deploy Falco or Tetragon for container escape detection — Runtime security tools monitoring for unexpected capability acquisition, namespace escape, or setuid(0) from container contexts provide detective control. Not preventive, but reduces dwell time. Deploy within 30 days.

Run this script on each target Linux host as any user (no root required for the version check). Invoke with: bash check_cve_2026_43074.sh. The script checks the running kernel version against known-fixed versions for major distributions and outputs VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check_cve_2026_43074.sh — CVE-2026-43074 eventpoll UAF version check
# Run on target host. No root required.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

KERNEL=$(uname -r)
echo "[*] Running kernel: $KERNEL"

# Extract major.minor.patch
MAJOR=$(echo "$KERNEL" | cut -d. -f1)
MINOR=$(echo "$KERNEL" | cut -d. -f2)
PATCH=$(echo "$KERNEL" | cut -d. -f3 | cut -d- -f1)

# Kernels before 6.6 are NOT AFFECTED (vulnerable commit not present)
if [ "$MAJOR" -lt 6 ] || { [ "$MAJOR" -eq 6 ] && [ "$MINOR" -lt 6 ]; }; then
  echo "[+] PATCHED — Kernel $KERNEL predates the vulnerable code (introduced in 6.6+)."
  exit 0
fi

# Check for distro-specific fixed versions
VULNERABLE=false
if [ -f /etc/os-release ]; then
  . /etc/os-release
  case "${ID:-unknown}" in
    rhel|centos|rocky|alma|ol)
      echo "[*] Detected RHEL-family: $PRETTY_NAME"
      # RHSA-2026:36186 and RHSA-2026:37729 provide fixes
      # Check if kernel RPM includes the fix
      if rpm -q --quiet kernel 2>/dev/null; then
        INSTALLED=$(rpm -q kernel --qf '%{VERSION}-%{RELEASE}\n' | sort -V | tail -1)
        echo "[*] Installed kernel RPM: $INSTALLED"
        echo "[!] Verify against RHSA-2026:36186 / RHSA-2026:37729 advisory fixed versions."
      fi
      VULNERABLE=true
      ;;
    debian)
      echo "[*] Detected Debian: $PRETTY_NAME"
      # Trixie fixed in 6.12.85-1, Forky in 7.1.7-1
      if dpkg --compare-versions "$KERNEL" ge "6.12.85" 2>/dev/null; then
        echo "[+] PATCHED — Kernel $KERNEL is at or above Debian fix (6.12.85-1)."
        exit 0
      fi
      VULNERABLE=true
      ;;
    ubuntu)
      echo "[*] Detected Ubuntu: $PRETTY_NAME"
      # Check for ubuntu-specific patched kernel
      echo "[!] Check Ubuntu security tracker for linux package fix status."
      VULNERABLE=true
      ;;
    *)
      echo "[*] Detected: ${PRETTY_NAME:-unknown}"
      VULNERABLE=true
      ;;
  esac
else
  VULNERABLE=true
fi

# Mainline check: upstream fix is in 7.0+ stable
if [ "$MAJOR" -ge 7 ] && [ "$MINOR" -ge 0 ]; then
  # Check if running a post-fix 7.x kernel
  if [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 1 ] && [ "${PATCH:-0}" -ge 7 ]; then
    echo "[+] PATCHED — Kernel $KERNEL is at or above upstream fix (7.1.7+)."
    exit 0
  elif [ "$MAJOR" -gt 7 ] || { [ "$MAJOR" -eq 7 ] && [ "$MINOR" -gt 1 ]; }; then
    echo "[+] PATCHED — Kernel $KERNEL is above known vulnerable range."
    exit 0
  fi
fi

if $VULNERABLE; then
  echo "[-] VULNERABLE — Kernel $KERNEL is in the affected range (6.6+) and no distro fix was confirmed."
  echo "    Fix: update kernel and REBOOT. A patched package on disk does NOT protect until reboot."
  exit 1
fi

echo "[?] UNKNOWN — Could not determine patch status for kernel $KERNEL. Manual review required."
exit 2

Sources

1. Red Hat Bugzilla – CVE-2026-43074
2. RHSA-2026:36186 Security Advisory
3. Debian Security Tracker – CVE-2026-43074
4. NVD – CVE-2026-43074
5. Penligent – Safe Validation Workflow for CVE-2026-43074
6. The CyberSec Guru – Bad Epoll CVE-2026-46242 Analysis
7. Upstream Fix Commit 07712db80857