CVE-2026-74606 is a use-after-free vulnerability in the Linux kernel's eventfs subsystem. The eventfs_remove_rec() function recursively removes child entries, but after a recursive call, it advances the list iterator by reading from a child that may have been freed. Specifically, if free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback, and the child may be freed before list_for_each_entry() reads the next pointer. The eventfs_mutex protects list updates but does not keep the removed child alive or prevent the SRCU callback from running. The fix replaces list_for_each_entry() with list_for_each_entry_safe(), which saves the next sibling pointer before recursive removal, preventing use-after-free.

This vulnerability could cause the kernel to access freed memory, potentially leading to kernel crashes or undefined behavior. No direct evidence of exploitation in the wild is reported. The impact is limited to kernel stability and security, possibly allowing local privilege escalation or denial of service if exploited.

A fix has been implemented in the Linux kernel to address this vulnerability by changing the list iteration method in eventfs_remove_rec() to use list_for_each_entry_safe(). Users should apply the official kernel updates that include this fix. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the official Linux kernel advisories or distributions for the specific patched versions.