---
id: CVE-2026-99173
title: 'eventfs: Free the eventfs_inode after an rcu grace period too'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  eventfs: Free the eventfs_inode after an rcu grace period too

  tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that
  dentry->d_fsdata points to, and ->d_rev…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8e556432477e97ad6179c61b61a32bf5f1af2355 <
    4586ef24ce390e8becb9f3e5852d5d3978b01c33
  - >-
    Linux >= 8e556432477e97ad6179c61b61a32bf5f1af2355 <
    45fcfd5d9c10e0aa977ed5b9bd445707e01bb107
  - >-
    Linux >= 8e556432477e97ad6179c61b61a32bf5f1af2355 <
    2cd88c498ecff8e22bf4c397b8eb226db70ac343
  - Linux 2ef3d120d19faba3dec35b10a025b00db0284373
  - Linux 384f383c5aa7bfd619d9f56a513a36e533428186
  - Linux >= 6.6.46 < 6.7
  - Linux >= 6.10.5 < 6.11
  - Linux 6.11
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:35:28.017Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99173'
references:
  - url: 'https://git.kernel.org/stable/c/4586ef24ce390e8becb9f3e5852d5d3978b01c33'
  - url: 'https://git.kernel.org/stable/c/45fcfd5d9c10e0aa977ed5b9bd445707e01bb107'
  - url: 'https://git.kernel.org/stable/c/2cd88c498ecff8e22bf4c397b8eb226db70ac343'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.384Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Free the eventfs_inode after an rcu grace period too

tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that
dentry->d_fsdata points to, and ->d_revalidate() is called in rcu
pathwalk mode with nothing but rcu_read_lock() held. The dentry itself
stays around for such a walker, but tracefs_d_release() drops its
reference to the eventfs_inode when the dentry is killed, and
release_ei() then frees it after a grace period of eventfs_srcu. An
SRCU grace period doesn't wait for rcu_read_lock() sections, so the
walker can read an eventfs_inode that is already gone.

With a pathwalk held up in tracefs_d_revalidate() while the dentry goes
away:

  BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90
  Read of size 1 at addr ff1100010152d8d0 by task walker/97
  Call Trace:
   <TASK>
   tracefs_d_revalidate+0x76/0x90
   lookup_fast+0x320/0x640
   path_lookupat+0x160/0xb00
   filename_lookup+0x1f1/0x5b0
   vfs_statx+0xd7/0x3b0
   vfs_fstatat+0x4d/0x90
   __do_sys_newfstatat+0xa0/0x100
   do_syscall_64+0x10e/0x5e0
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
  [...]
  Allocated by task 1:
   __kmalloc_cache_noprof+0x249/0x560
   eventfs_create_dir+0x7a/0x590
   event_create_dir+0x2fb/0xcf0
   trace_add_event_call+0xbf/0x150
  [...]
  Freed by task 11:
   kfree+0x1db/0x5b0
   srcu_invoke_callbacks+0x3a3/0x620
   process_one_work+0x937/0x1810
   worker_thread+0x4f1/0xd60

Before commit 8e556432477e ("eventfs: Use SRCU for freeing
eventfs_inodes") release_ei() used call_rcu(), which covered the walker,
while eventfs_iterate() needs the SRCU grace period. Wait for both and
chain call_rcu() from the SRCU callback.

## Affected

- `Linux >= 8e556432477e97ad6179c61b61a32bf5f1af2355 < 4586ef24ce390e8becb9f3e5852d5d3978b01c33`
- `Linux >= 8e556432477e97ad6179c61b61a32bf5f1af2355 < 45fcfd5d9c10e0aa977ed5b9bd445707e01bb107`
- `Linux >= 8e556432477e97ad6179c61b61a32bf5f1af2355 < 2cd88c498ecff8e22bf4c397b8eb226db70ac343`
- `Linux 2ef3d120d19faba3dec35b10a025b00db0284373`
- `Linux 384f383c5aa7bfd619d9f56a513a36e533428186`
- `Linux >= 6.6.46 < 6.7`
- `Linux >= 6.10.5 < 6.11`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.