CVE-2026-99173
Received Received - Intake

Use-After-Free in Linux Kernel eventfs Subsystem

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its reference to the eventfs_inode when the dentry is killed, and release_ei() then frees it after a grace period of eventfs_srcu. An SRCU grace period doesn't wait for rcu_read_lock() sections, so the walker can read an eventfs_inode that is already gone. With a pathwalk held up in tracefs_d_revalidate() while the dentry goes away: BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90 Read of size 1 at addr ff1100010152d8d0 by task walker/97 Call Trace: <TASK> tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] Allocated by task 1: __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0 trace_add_event_call+0xbf/0x150 [...] Freed by task 11: kfree+0x1db/0x5b0 srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 Before commit 8e556432477e ("eventfs: Use SRCU for freeing eventfs_inodes") release_ei() used call_rcu(), which covered the walker, while eventfs_iterate() needs the SRCU grace period. Wait for both and chain call_rcu() from the SRCU callback.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-99173
EUVD
EUVD-2026-111925

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
Linux Linux 8e556432477e97ad6179c61b61a32bf5f1af2355
Linux Linux 8e556432477e97ad6179c61b61a32bf5f1af2355
Linux Linux 8e556432477e97ad6179c61b61a32bf5f1af2355
Linux Linux 2ef3d120d19faba3dec35b10a025b00db0284373
Linux Linux 384f383c5aa7bfd619d9f56a513a36e533428186
Linux Linux 6.6.46
Linux Linux 6.10.5
Linux Linux 6.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's eventfs subsystem. It occurs when tracefs_d_revalidate() reads an eventfs_inode that has already been freed. The issue happens because an SRCU grace period does not wait for RCU read-side critical sections, allowing a pathwalk to access freed memory while the dentry is being destroyed.

Detection Guidance

This vulnerability is specific to the Linux kernel's eventfs subsystem and requires kernel-level detection. Check kernel logs for KASAN slab-use-after-free errors related to tracefs_d_revalidate or eventfs_inode. Use commands like dmesg | grep -i kasan or journalctl -k | grep -i kasan to search for memory corruption issues.

Impact Analysis

This vulnerability can cause system crashes or kernel panics due to slab-use-after-free errors. Attackers could potentially exploit this to execute arbitrary code with kernel privileges, leading to full system compromise. It may also cause data corruption or denial-of-service conditions on affected systems.

Mitigation Strategies

Apply the latest Linux kernel security patches that include the fix for this issue. The vulnerability is resolved in kernel versions after commit 8e556432477e. If immediate patching is not possible, consider disabling tracefs or restricting access to kernel debug interfaces as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99173. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart