CVE-2026-89618

Received Received - Intake

Linux Kernel Memory Corruption in eventfs

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei->children and ei->list in init_ei() eventfs_create_dir() allocates the eventfs_inode and initializes it with init_ei(). But this does not initialize the eventfs_inode list_heads. If the eventfs_create_dir() fails due to memory pressure, it will call free_ei() before it initialized the lists, and that checks to make sure the eventfs_inode has no children. But because the list wasn't initialized, it will give a false warning. Fix it by moving the list initialization into init_ei(). [ Rewrote change log ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89618

EUVD

EUVD-2026-76530

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where eventfs_create_dir() fails to initialize list heads in the eventfs_inode structure. If memory allocation fails during directory creation, free_ei() incorrectly checks for children due to uninitialized list heads, causing false warnings.

Detection Guidance

This vulnerability is specific to the Linux kernel's eventfs subsystem and may not have direct network detection methods. Check kernel logs for eventfs-related errors or warnings using commands like 'dmesg | grep eventfs' or 'journalctl -k | grep eventfs'.

Impact Analysis

This could lead to kernel crashes or instability if memory pressure triggers the uninitialized list check during eventfs operations. It may cause system freezes or require reboots to recover.

Mitigation Strategies

Update your Linux kernel to the latest patched version to ensure the fix for eventfs initialization is applied. Monitor system logs for eventfs-related errors after updating.

Hi! I’m here to help you understand CVE-2026-89618. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70