[SRU][N:linux-hwe-6.17][PATCH 0/1] CVE-2026-43074

[Fedor Veselovskii]

From: fviolence <asetium at gmail.com>

https://ubuntu.com/security/CVE-2026-43074

[ Impact ]

Noble linux-hwe-6.17 is vulnerable to CVE-2026-43074. An RCU epoll graph
traversal can retain a pointer to a struct eventpoll while ep_free() releases
that object, resulting in a use-after-free.

[ Fix ]

Backport upstream commit 07712db80857d5d09ae08f3df85a708ecfc3b61f.
Add an rcu_head to struct eventpoll and defer the final object free with
kfree_rcu(), allowing pre-existing RCU graph readers to complete before the
memory is reclaimed.

[ Test Plan ]

- Built Ubuntu linux-hwe-6.17 amd64 packages successfully.
- Booted the resulting generic kernel and exercised normal server workloads.
- Ran the complete epoll selftest suite: 64 passed, 0 failed, 0 skipped.
- Ran stress-ng with two epoll workers for 10 minutes with verification:
  0 failures.
- Ran global.epoll38 in isolation 1000 times on both kernels:
    - patched kernel: 2 failures / 1000
    - unmodified Ubuntu 6.17.0-40 kernel: 1 failure / 1000
  All three failures hit the same timing-sensitive assertion. This reproduces
  the sporadic failure on the unmodified Ubuntu kernel and does not show a
  patch-specific failure mode.
- Kernel taint remained 0. No kernel oops, use-after-free report, call trace,
  lockup, RCU stall, or eventpoll warning was observed.
- No failed systemd services were present and normal container workloads
  remained operational.

[ Where problems could occur ]

The change defers reclamation of struct eventpoll until an RCU grace period.
A regression could appear as delayed or leaked eventpoll reclamation, an RCU
callback problem, or a failure during destruction of nested epoll graphs.

[ Other Info ]

The patch was adapted to Ubuntu 6.17's eventpoll layout. It should be submitted
as an independent one-patch series based directly on the Ubuntu staging base,
not as a patch that depends on the CVE-2026-46242 series.

Nicholas Carlini (1):
  eventpoll: defer struct eventpoll free to RCU grace period

 fs/eventpoll.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

-- 
2.43.0