In the Linux kernel, the following vulnerability has been resolved:
list: fix a data-race around ep->rdllist
ep_poll() first calls ep_events_available() with no lock held and checks if ep->rdllist is empty by list_empty_careful(), which reads rdllist->prev. Thus all accesses to it need some protection to avoid store/load-tearing.
Note INIT_LIST_HEAD_RCU() already has the annotation for both prev and next.
Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless ep_events_available(), and commit c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()") made some ep_events_available() calls lockless and added single call under a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") made the last ep_events_available() lockless.
BUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait
write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0: INIT_LIST_HEAD include/linux/list.h:38 [inline] list_splice_init include/linux/list.h:492 [inline] ep_start_scan fs/eventpoll.c:622 [inline] ep_send_events fs/eventpoll.c:1656 [inline] ep_poll fs/eventpoll.c:1806 [inline] do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1: list_empty_careful include/linux/list.h:329 [inline] ep_events_available fs/eventpoll.c:381 [inline] ep_poll fs/eventpoll.c:1797 [inline] do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0xffff88810480c7d0 -> 0xffff888103c15098
Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-devel-matchedUpgrade kernel-headersUpgrade kernel-rt-modules-coreUpgrade perfUpgrade kernel-modules-coreUpgrade kernel-debug-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-64k-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-64k-develUpgrade kernel-debug-devel-matchedUpgrade kernel-modules-extraUpgrade kernel-rt-64k-modules-coreUpgrade kernel-docUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-modulesUpgrade kernel-64k-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-coreUpgrade rtlaUpgrade kernel-zfcpdump-develUpgrade libperfUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-develUpgrade kernel-abi-stablelistsUpgrade kernel-coreUpgrade kernel-uki-virtUpgrade kernel-debug-uki-virtUpgrade kernel-debugUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-tools-libsUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debugUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-64k-debugUpgrade kernel-64k-debug-develUpgrade kernel-rt-64k-coreUpgrade kernelUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perfUpgrade kernel-tools-libs-develUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade rvUpgrade kernel-rt-modules-extraUpgrade kernel-rt-64k-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-64kUpgrade kernel-rt-debugUpgrade kernel-debug-modulesUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-64k-devel-matchedUpgrade kernel-64kUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-modules-extraUpgrade kernel-cross-headersUpgrade kernel-64k-modulesUpgrade kernel-develUpgrade kernel-rt-devel | Nov 20, 2025 | Nov 11, 2025 |
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade perf-debuginfoUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade perfUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade python-perfUpgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.50-23.125Upgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel | May 22, 2025 | Feb 26, 2025 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade python3-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libs | Jun 13, 2025 | Feb 26, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libs | Jun 11, 2025 | Feb 26, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel | Jul 1, 2025 | Feb 26, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Feb 26, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jul 9, 2025 | Feb 26, 2025 |
| Rocky_linux | — | Upgrade kernel-tools-libs-develUpgrade kernel-toolsUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-rtUpgrade kernel-uki-virt-addonsUpgrade rvUpgrade kernel-debug-modules-coreUpgrade kernel-rt-modules-coreUpgrade libperfUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdump-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade libperf-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade perf-debuginfoUpgrade kernel-debug-develUpgrade perfUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debugUpgrade kernel-modulesUpgrade kernel-debugUpgrade kernel-rt-debug-modulesUpgrade kernel-develUpgrade python3-perf-debuginfoUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade kernel-modules-extraUpgrade python3-perfUpgrade kernel-rt-develUpgrade kernel-tools-libsUpgrade kernel-rt-coreUpgrade kernel-tools-debuginfoUpgrade kernel-debug-coreUpgrade kernelUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debug-uki-virtUpgrade rtlaUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debuginfoUpgrade kernel-modules-core | Feb 5, 2026 | Nov 21, 2025 |
| Ubuntu | — | Upgrade linux-gkeUpgrade linux-lowlatencyUpgrade linux-aws-5.15Upgrade linux-riscv-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-realtimeUpgrade linuxUpgrade linux-intel-iotgUpgrade linux-hwe-5.15Upgrade linux-raspiUpgrade linux-oracle-5.15Upgrade linux-awsUpgrade linux-intel-iotg-5.15Upgrade linux-kvmUpgrade linux-nvidiaUpgrade linux-azureUpgrade linux-gcp-5.15Upgrade linux-oracleUpgrade linux-azure-5.15Upgrade linux-ibmUpgrade linux-gcpUpgrade linux-gkeop | Mar 19, 2025 | Feb 26, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub