CVE-2026-99173eventfs: Free the eventfs_inode after an rcu grace period too
- 7.8HighCVSS base score
- 0.13%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its reference to the eventfs_inode when the dentry is killed, and release_ei() then frees it after a grace period of eventfs_srcu. An SRCU grace period doesn't wait for rcu_read_lock() sections, so the walker can read an eventfs_inode that is already gone. With a pathwalk held up in tracefs_d_revalidate() while the dentry goes away: BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90 Read of size 1 at addr ff1100010152d8d0 by task walker/97 Call Trace: <TASK> tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] Allocated by task 1: __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0 trace_add_event_call+0xbf/0x150 [...] Freed by task 11: kfree+0x1db/0x5b0 srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 Before commit 8e556432477e ("eventfs: Use SRCU for freeing eventfs_inodes") release_ei() used call_rcu(), which covered the walker, while eventfs_iterate() needs the SRCU grace period. Wait for both and chain call_rcu() from the SRCU callback.
Timeline
ID reserved
By Linux
- 33 days later
· 33 days later
Published
- 3 days later
· 3 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.13% · top 98% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 2ef3d120d19faba3dec35b10a025b00db0284373 – < 5819018dc29fb2ac2fd4865d507f9893c89c0624
- affected 8e556432477e97ad6179c61b61a32bf5f1af2355 – < dd2c767814a876be0f16f0b7f98a403dc176f51e
- affected 8e556432477e97ad6179c61b61a32bf5f1af2355 – < 4586ef24ce390e8becb9f3e5852d5d3978b01c33
- affected 8e556432477e97ad6179c61b61a32bf5f1af2355 – < 45fcfd5d9c10e0aa977ed5b9bd445707e01bb107
- affected 8e556432477e97ad6179c61b61a32bf5f1af2355 – < 2cd88c498ecff8e22bf4c397b8eb226db70ac343
- affected 384f383c5aa7bfd619d9f56a513a36e533428186
- affected 6.6.46 – < 6.6.161
- affected 6.10.5 – < 6.11
- affected 6.11
- unaffected < 6.11
- unaffected 6.6.161 – ≤ 6.6.*
- unaffected 6.12.115 – ≤ 6.12.*
- unaffected 6.18.59 – ≤ 6.18.*
- unaffected 7.2.13 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References5
- https://git.kernel.org/stable/c/5819018dc29fb2ac2fd4865d507f9893c89c0624 (opens in a new tab)
- https://git.kernel.org/stable/c/dd2c767814a876be0f16f0b7f98a403dc176f51e (opens in a new tab)
- https://git.kernel.org/stable/c/4586ef24ce390e8becb9f3e5852d5d3978b01c33 (opens in a new tab)
- https://git.kernel.org/stable/c/45fcfd5d9c10e0aa977ed5b9bd445707e01bb107 (opens in a new tab)
- https://git.kernel.org/stable/c/2cd88c498ecff8e22bf4c397b8eb226db70ac343 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-111925 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-99173)Record last updated .