[SRU][N:linux-hwe-6.17][PATCH 0/1] CVE-2026-46242

[Fedor Veselovskii]

From: fviolence <asetium at gmail.com>

https://ubuntu.com/security/CVE-2026-46242

[ Impact ]

Noble linux-hwe-6.17 is vulnerable to CVE-2026-46242. A race between
ordinary epoll watch removal and final file release can allow a struct file,
or a nested struct eventpoll watched through that file, to be freed or
recycled while epoll removal still uses it. This can result in a local
use-after-free and kernel memory corruption.

[ Fix ]

Backport upstream commit a6dc643c69311677c574a0f17a3f4d66a5f3744b
to Ubuntu 6.17's pre-refactor __ep_remove() implementation.

Pin the watched file with epi_fget()/fput() on ordinary removal paths. Keep
the raw file pointer on the force path, which runs from final __fput() after
the file reference count has already reached zero.

[ Test Plan ]

- Built Ubuntu linux-hwe-6.17 amd64 packages successfully.
- Booted the resulting generic kernel and exercised normal server workloads.
- Ran the complete epoll selftest suite: 64 passed, 0 failed, 0 skipped.
- Ran stress-ng with two epoll workers for 10 minutes with verification:
  0 failures.
- Ran global.epoll38 in isolation 1000 times on both kernels:
    - patched kernel: 2 failures / 1000
    - unmodified Ubuntu 6.17.0-40 kernel: 1 failure / 1000
  All three failures hit the same timing-sensitive assertion. This reproduces
  the sporadic failure on the unmodified Ubuntu kernel and does not show a
  patch-specific failure mode.
- Ran the complete futex selftest suite as root successfully and repeated it
  20 times without failure; one CPU-count-dependent test was skipped on the
  four-CPU test system.
- Kernel taint remained 0. No kernel oops, use-after-free report, call trace,
  lockup, RCU stall, or eventpoll/futex/rtmutex warning was observed.
- No failed systemd services were present and normal container workloads
  remained operational.

[ Where problems could occur ]

The change affects watched-file lifetime handling during epoll item removal.
A regression could appear as a file-reference leak, leaked epoll item,
deadlock during eventpoll release, or incorrect behavior when one epoll
instance watches another.

[ Other Info ]

The upstream change required adaptation because Ubuntu 6.17 retains the
pre-refactor __ep_remove(ep, epi, force) implementation.

Christian Brauner (1):
  eventpoll: fix ep_remove struct eventpoll / struct file UAF

 fs/eventpoll.c | 37 +++++++++++++++++++++++++++++++------
 1 file changed, 31 insertions(+), 6 deletions(-)

-- 
2.43.0