ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-99173

CVE-2026-99173: eventfs: Free the eventfs_inode after an rcu grace period too

Published Oct 28, 2026 · catalog updated Nov 2, 2026 · Linux Linux

Last checked Nov 7, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-99173. EPSS is 0.13%. Act only if a listed version of Linux Linux is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
High7.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.13%
Remediation
Advisory link
Affected products
Linux Kernel · linux kernel · vendor Linux Linux

In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its reference to the eventfs_inode when the dentry is killed, and release_ei() then frees it after a grace period of eventfs_srcu. An SRCU grace period doesn't wait for rcu_read_lock() sections, so the walker can read an eventfs_inode that is already gone. With a pathwalk held up in tracefs_d_revalidate() while the dentry goes away: BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90 Read of size 1 at addr ff1100010152d8d0 by task walker/97 Call Trace: tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] Allocated by task 1: __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0 trace_add_event_call+0xbf/0x150 [...] Freed by task 11: kfree+0x1db/0x5b0 srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 Before commit 8e556432477e ("eventfs: Use SRCU for freeing eventfs_inodes") release_ei() used call_rcu(), which covered the walker, while eventfs_iterate() needs the SRCU grace period. Wait for both and chain call_rcu() from the SRCU callback.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Linux Kernel0 → 6.6.161; 6.7.0 → 6.12.115; 6.11.0 → 6.18.59
  • Linux Kernel6.11.0 → 6.18.59; 6.19.0 → 7.2.13
  • linux kernelversion unspecified
  • vendor Linux Linuxversion unspecified

How to fix CVE-2026-99173

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-99173. EPSS is 0.13%. Act only if a listed version of Linux Linux is installed.

Which versions are affected?

Compare what you have installed with Kernel 0 → 6.6.161; 6.7.0 → 6.12.115; 6.11.0 → 6.18.59; Kernel 6.11.0 → 6.18.59; 6.19.0 → 7.2.13. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.13%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 28, 2026 · Tenable CVE Database

    Detected

    In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its r

  2. Oct 28, 2026 · CVE.org

    Updated

    In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its r

  3. Oct 30, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 6.18.59; Kernel fixed in 7.2.13

  4. Oct 30, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 6.18.59; 6.19.0

  5. Oct 30, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its r

  6. Nov 2, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 6.6.161; Kernel fixed in 6.12.115; Kernel fixed in 6.18.59; Kernel fixed in 7.2.13

  7. Nov 2, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 6.6.161; 6.7.0

  8. Nov 2, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its r

Sources

  • BSI CERT-BundGovernment advisoryCVE-2026-99173

    Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

    wid.cert-bund.de
  • CVE.orgVulnerability recordCVE-2026-99173

    In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-99173

    30-day exploitation probability 0.13%

    first.org
  • Linux Kernel CVEVendor advisoryCVE-2026-99173

    From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d

    git.kernel.org
  • OpenSSF OSV / OSV ScannerPackage advisoryCVE-2026-99173

    eventfs: Free the eventfs_inode after an rcu grace period too

    osv.dev
  • Tenable CVE DatabaseVulnerability recordCVE-2026-99173

    In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its r

    tenable.com

References

Freshness

Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 7, 2026
  • OpenSSF OSV / OSV ScannerNov 2, 2026
  • Tenable CVE DatabaseNov 1, 2026
  • BSI CERT-BundOct 30, 2026
  • CVE.orgOct 29, 2026
  • Linux Kernel CVEOct 28, 2026