Cloudanix VulnDB

CVE-2026-99173

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A memory handling mistake in the Linux kernel could let attackers interfere with system operations or cause crashes.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in tracefs_d_revalidate() allowing an RCU pathwalk to read an eventfs_inode that has already been freed by release_ei() after an SRCU grace period.

Why it matters to the business

Potential kernel crash or arbitrary code execution on systems running affected Linux kernels, increasing risk of denial of service or full system compromise with high urgency due to recent publication.

How an attack unfolds

An attacker triggers repeated path lookups on eventfs dentries while the dentry is being released, causing a concurrent RCU walker to dereference a freed eventfs_inode structure and read the is_freed field.

How to fix it

Update to a Linux kernel containing the fix that chains call_rcu() after the SRCU grace period in release_ei(); apply the latest stable kernel for your distribution.

How to confirm the fix worked

Confirm kernel version contains commit 8e556432477e or later equivalent; reproduce the original KASAN report path and verify no slab-use-after-free occurs.

Typical attack path

  1. Mount or access tracefs/eventfs directories to populate dentries
  2. Trigger dentry invalidation and release while holding a slow pathwalk
  3. Perform stat or lookup syscalls that invoke tracefs_d_revalidate under RCU
  4. Read freed memory leading to KASAN-detected use-after-free or exploitable corruption

How to detect it

Inspect kernel logs for KASAN slab-use-after-free reports referencing tracefs_d_revalidate; look for unusual pathwalk activity on tracefs dentries in audit or syscall logs.

What your security team should do

  • Prioritize kernel upgrades on all systems exposing tracefs
  • Monitor for new stable kernel releases containing the RCU/SRCU fix
  • Restrict unprivileged access to tracefs mounts until patched

The record

In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its reference to the eventfs_inode when the dentry is killed, and release_ei() then frees it after a grace period of eventfs_srcu. An SRCU grace period doesn't wait for rcu_read_lock() sections, so the walker can read an eventfs_inode that is already gone. With a pathwalk held up in tracefs_d_revalidate() while the dentry goes away: BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90 Read of size 1 at addr ff1100010152d8d0 by task walker/97 Call Trace: <TASK> tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] Allocated by task 1: __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0 trace_add_event_call+0xbf/0x150 [...] Freed by task 11: kfree+0x1db/0x5b0 srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 Before commit 8e556432477e ("eventfs: Use SRCU for freeing eventfs_inodes") release_ei() used call_rcu(), which covered the walker, while eventfs_iterate() needs the SRCU grace period. Wait for both and chain call_rcu() from the SRCU callback.

Affected packages

Ecosystem Package Introduced Fixed