CVE-2026-99173

Status: UPDATED  |  Advisory ID: CVE-2026-99173

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Free the eventfs_inode after an rcu grace period too

tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that

dentry->d_fsdata points to, and ->d_revalidate() is called in rcu

pathwalk mode with nothing but rcu_read_lock() held. The dentry itself

stays around for such a walker, but tracefs_d_release() drops its

reference to the eventfs_inode when the dentry is killed, and

release_ei() then frees it after a grace period of eventfs_srcu. An

SRCU grace period doesn't wait for rcu_read_lock() sections, so the

walker can read an eventfs_inode that is already gone.

With a pathwalk held up in tracefs_d_revalidate() while the dentry goes

away:

BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90

Read of size 1 at addr ff1100010152d8d0 by task walker/97

Call Trace:

<TASK>

tracefs_d_revalidate+0x76/0x90

lookup_fast+0x320/0x640

path_lookupat+0x160/0xb00

filename_lookup+0x1f1/0x5b0

vfs_statx+0xd7/0x3b0

vfs_fstatat+0x4d/0x90

__do_sys_newfstatat+0xa0/0x100

do_syscall_64+0x10e/0x5e0

entry_SYSCALL_64_after_hwframe+0x77/0x7f

[...]

Allocated by task 1:

__kmalloc_cache_noprof+0x249/0x560

eventfs_create_dir+0x7a/0x590

event_create_dir+0x2fb/0xcf0

trace_add_event_call+0xbf/0x150

[...]

Freed by task 11:

kfree+0x1db/0x5b0

srcu_invoke_callbacks+0x3a3/0x620

process_one_work+0x937/0x1810

worker_thread+0x4f1/0xd60

Before commit 8e556432477e ("eventfs: Use SRCU for freeing

eventfs_inodes") release_ei() used call_rcu(), which covered the walker,

while eventfs_iterate() needs the SRCU grace period. Wait for both and

chain call_rcu() from the SRCU callback. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References