Cloudanix VulnDB

CVE-2026-89618

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small coding mistake in the Linux kernel could cause confusing warning messages when memory is low, but it does not let attackers break in or steal data.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
None

What it actually does

Uninitialized list_heads in eventfs_inode cause free_ei() to incorrectly detect children during early failure paths in eventfs_create_dir() under memory pressure.

Why it matters to the business

Produces spurious kernel warnings that can mask real issues and increase alert fatigue for system administrators managing Linux hosts.

How an attack unfolds

No attacker exploitation path exists; the flaw only triggers a false warning during internal error handling and cannot be reached or abused by external input.

How to fix it

Apply the upstream kernel patch that moves list initialization into init_ei() or upgrade to a maintained kernel release containing the fix.

How to confirm the fix worked

Inspect the init_ei() function in fs/tracefs/event_inode.c to confirm list_head initializations for children and list fields are present before any allocation path.

Typical attack path

  1. N/A - not exploitable

How to detect it

Review kernel dmesg and syslog for the specific warning emitted by free_ei() when lists appear non-empty on early free; no post-exploitation artifacts exist.

What your security team should do

  • Prioritize normal kernel updates during scheduled maintenance windows
  • Monitor kernel logs for the specific false-positive warning pattern until patched
  • No emergency patching required given low EPSS and absence from KEV

The record

In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei->children and ei->list in init_ei() eventfs_create_dir() allocates the eventfs_inode and initializes it with init_ei(). But this does not initialize the eventfs_inode list_heads. If the eventfs_create_dir() fails due to memory pressure, it will call free_ei() before it initialized the lists, and that checks to make sure the eventfs_inode has no children. But because the list wasn't initialized, it will give a false warning. Fix it by moving the list initialization into init_ei(). [ Rewrote change log ]

Affected packages

Ecosystem Package Introduced Fixed