ACK: [SRU][N:hwe-6.17][PATCH 0/1] CVE-2026-46242

[Alessio Faina]

On Thu, Jul 23, 2026 at 12:10:15AM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-46242
> 
> [ Impact ]
> 
> ep_remove() cleared file->f_ep under file->f_lock but kept using @file
> inside the critical section (is_file_epoll(), hlist_del_rcu() through the
> head, spin_unlock). A concurrent __fput() taking the eventpoll_release()
> fastpath in that window could free the file, and for the epoll-watches-epoll
> case the watched struct eventpoll, so the subsequent hlist_del_rcu() writes
> into freed memory. struct file is SLAB_TYPESAFE_BY_RCU, so the slot could be
> recycled, giving an attacker-controllable kmem_cache_free() against the
> wrong slab cache.
> 
> [ Fix ]
> 
> noble/linux-hwe-6.17: backported, adapted to this tree's monolithic
> __ep_remove(ep, epi, force). The upstream fix targets a refactored eventpoll
> (split ep_remove_file/ep_remove_epi, no force parameter). It is adapted here
> to pin @file via epi_fget() only on the !force path, keep the raw unpinned
> file on the force (eventpoll_release_file) path, drop the redundant
> under-lock epi->dying recheck, and forward-declare epi_fget().
> 
> [ Test Plan ]
> 
> Build tested only (CBD).
> 
> [ Where Problems Could Occur ]
> 
> The change is in the eventpoll removal path (fs/eventpoll.c). A wrong pin or
> fput could leak a file reference or, on the force teardown path, loop; the
> adaptation was reviewed against upstream a6dc643c6931 and the 6.12.y stable
> backport. It affects epoll users only.
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Acked-by: Alessio Faina <alessio.faina at canonical.com>