APPLIED: [SRU][N:hwe-6.17][PATCH 0/1] CVE-2026-46242

[Edoardo Canepa]

Applied to n:linux/hwe-6.17-next. Thanks.

On 7/22/26 23:10, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-46242
>
> [ Impact ]
>
> ep_remove() cleared file->f_ep under file->f_lock but kept using @file
> inside the critical section (is_file_epoll(), hlist_del_rcu() through the
> head, spin_unlock). A concurrent __fput() taking the eventpoll_release()
> fastpath in that window could free the file, and for the epoll-watches-epoll
> case the watched struct eventpoll, so the subsequent hlist_del_rcu() writes
> into freed memory. struct file is SLAB_TYPESAFE_BY_RCU, so the slot could be
> recycled, giving an attacker-controllable kmem_cache_free() against the
> wrong slab cache.
>
> [ Fix ]
>
> noble/linux-hwe-6.17: backported, adapted to this tree's monolithic
> __ep_remove(ep, epi, force). The upstream fix targets a refactored eventpoll
> (split ep_remove_file/ep_remove_epi, no force parameter). It is adapted here
> to pin @file via epi_fget() only on the !force path, keep the raw unpinned
> file on the force (eventpoll_release_file) path, drop the redundant
> under-lock epi->dying recheck, and forward-declare epi_fget().
>
> [ Test Plan ]
>
> Build tested only (CBD).
>
> [ Where Problems Could Occur ]
>
> The change is in the eventpoll removal path (fs/eventpoll.c). A wrong pin or
> fput could leak a file reference or, on the force teardown path, loop; the
> adaptation was reviewed against upstream a6dc643c6931 and the 6.12.y stable
> backport. It affects epoll users only.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x20F88172E14F6784.asc
Type: application/pgp-keys
Size: 3167 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260723/db4e6a49/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260723/db4e6a49/attachment-0001.sig>