[SRU][N:hwe-6.17][PATCH 0/1] CVE-2026-46242

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-46242

[ Impact ]

ep_remove() cleared file->f_ep under file->f_lock but kept using @file
inside the critical section (is_file_epoll(), hlist_del_rcu() through the
head, spin_unlock). A concurrent __fput() taking the eventpoll_release()
fastpath in that window could free the file, and for the epoll-watches-epoll
case the watched struct eventpoll, so the subsequent hlist_del_rcu() writes
into freed memory. struct file is SLAB_TYPESAFE_BY_RCU, so the slot could be
recycled, giving an attacker-controllable kmem_cache_free() against the
wrong slab cache.

[ Fix ]

noble/linux-hwe-6.17: backported, adapted to this tree's monolithic
__ep_remove(ep, epi, force). The upstream fix targets a refactored eventpoll
(split ep_remove_file/ep_remove_epi, no force parameter). It is adapted here
to pin @file via epi_fget() only on the !force path, keep the raw unpinned
file on the force (eventpoll_release_file) path, drop the redundant
under-lock epi->dying recheck, and forward-declare epi_fget().

[ Test Plan ]

Build tested only (CBD).

[ Where Problems Could Occur ]

The change is in the eventpoll removal path (fs/eventpoll.c). A wrong pin or
fput could leak a file reference or, on the force teardown path, loop; the
adaptation was reviewed against upstream a6dc643c6931 and the 6.12.y stable
backport. It affects epoll users only.