{"id":"CVE-2026-99173","kind":"vulnerability","aliases":["CVE-2026-99173"],"related":[],"title":"Linux kernel tracefs: use-after-free in eventfs revalidation during dentry release","description":"In the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Free the eventfs_inode after an rcu grace period too\n\ntracefs_d_revalidate() reads ->is_freed of the eventfs_inode that\ndentry->d_fsdata points to, and ->d_revalidate() is called in rcu\npathwalk mode with nothing but rcu_read_lock() held. The dentry itself\nstays around for such a walker, but tracefs_d_release() drops its\nreference to the eventfs_inode when the dentry is killed, and\nrelease_ei() then frees it after a grace period of eventfs_srcu. An\nSRCU grace period doesn't wait for rcu_read_lock() sections, so the\nwalker can read an eventfs_inode that is already gone.\n\nWith a pathwalk held up in tracefs_d_revalidate() while the dentry goes\naway:\n\n  BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90\n  Read of size 1 at addr ff1100010152d8d0 by task walker/97\n  Call Trace:\n   <TASK>\n   tracefs_d_revalidate+0x76/0x90\n   lookup_fast+0x320/0x640\n   path_lookupat+0x160/0xb00\n   filename_lookup+0x1f1/0x5b0\n   vfs_statx+0xd7/0x3b0\n   vfs_fstatat+0x4d/0x90\n   __do_sys_newfstatat+0xa0/0x100\n   do_syscall_64+0x10e/0x5e0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  [...]\n  Allocated by task 1:\n   __kmalloc_cache_noprof+0x249/0x560\n   eventfs_create_dir+0x7a/0x590\n   event_create_dir+0x2fb/0xcf0\n   trace_add_event_call+0xbf/0x150\n  [...]\n  Freed by task 11:\n   kfree+0x1db/0x5b0\n   srcu_invoke_callbacks+0x3a3/0x620\n   process_one_work+0x937/0x1810\n   worker_thread+0x4f1/0xd60\n\nBefore commit 8e556432477e (\"eventfs: Use SRCU for freeing\neventfs_inodes\") release_ei() used call_rcu(), which covered the walker,\nwhile eventfs_iterate() needs the SRCU grace period. Wait for both and\nchain call_rcu() from the SRCU callback.","summary":"In the Linux kernel's tracefs/eventfs code, a path lookup running under RCU can read an eventfs_inode that was already freed when its dentry is torn down. The sources describe a KASAN slab-use-after-free, which can crash the kernel or let a local user read freed memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","other","self-hosted","tracing"],"not_affected_if":["tracefs-not-mounted"],"how_to_check":"- Run `uname -r` and compare the running kernel against the fixed kernel versions in the stable tree (unknown: the sources do not list them)\n- Check whether tracefs is mounted with `mount | grep tracefs` (unknown: the sources do not say this is the only trigger)","fix":"- Update the Linux kernel to a release that contains the upstream eventfs fix (unknown: the sources do not name the fixed version)\n- Reboot into the patched kernel after updating","status":"open","published_at":"2026-10-28T11:17:37+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:34+00:00","updated_at":"2026-10-28T11:35:34+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-28T11:35:34Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that contains the upstream eventfs fix (unknown: the sources do not name the fixed version)\n- Reboot into the patched kernel after updating","reach":"local","title":"Linux kernel tracefs: use-after-free in eventfs revalidation during dentry release","impact":"medium","summary":"In the Linux kernel's tracefs/eventfs code, a path lookup running under RCU can read an eventfs_inode that was already freed when its dentry is torn down. The sources describe a KASAN slab-use-after-free, which can crash the kernel or let a local user read freed memory.","category":"other","nicknames":[],"who_cares":["linux-kernel","self-hosted","tracing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel memory corruption or crash; possible read of freed kernel memory","analyst_note":"Check the upstream kernel stable commit for 8e556432477e and the fixed version ranges; the sources give no fixed version or CVSS score.","how_to_check":"- Run `uname -r` and compare the running kernel against the fixed kernel versions in the stable tree (unknown: the sources do not list them)\n- Check whether tracefs is mounted with `mount | grep tracefs` (unknown: the sources do not say this is the only trigger)","needs_analyst":true,"not_affected_if":["tracefs-not-mounted"],"who_is_affected":"Systems running a Linux kernel with eventfs and tracefs in use, typically hosts where ftrace or tracing is mounted. The sources do not say whether unprivileged users can trigger it, and tracefs is usually only mounted on machines that use kernel tracing. Machines without tracefs mounted are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000728,"input_tokens":4063,"output_tokens":643,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':219C,236C,240C,244C,248C,252C,256C,261C,266C,273C,282C,287C,292C,298C,305C,310C,315C,319C '-2026':15A,18A '-99173':16A,19A '1':224C,278C '11':303C '64':265C,270C '8e556432477':323C 'add':295C 'addr':226C 'alloc':275C 'alreadi':48B,192C 'around':136C 'away':207C 'bug':208C 'cach':280C 'call':120C,231C,297C,335C,354C 'callback':309C,359C 'chain':353C 'code':34B 'commit':322C 'cover':338C 'crash':68B 'creat':285C,290C 'cve':14A,17A 'd':101C,112C,117C,143C,201C,217C,234C 'dentri':12A,52B,111C,133C,154C,205C 'describ':58B 'dir':286C,291C 'doesn':174C 'drop':145C 'e':324C 'ei':159C,333C 'entri':268C 'event':289C,296C 'eventf':9A,44B,89C,92C,108C,150C,168C,188C,284C,325C,330C,342C 'fast':239C 'ff1100010152d8d0':227C 'filenam':246C 'follow':84C 'free':7A,65B,90C,161C,214C,329C 'freed':49B,77B,105C,300C 'fsdata':113C 'fstatat':255C 'goe':206C 'gone':193C 'grace':97C,165C,172C,347C 'held':131C,197C 'host':26B 'hwframe':272C 'inod':45B,93C,109C,151C,189C,331C 'invok':308C 'iter':343C 'kasan':60B,209C 'kernel':2A,22B,31B,70B,82C 'kfree':304C 'kill':156C 'kmalloc':279C 'let':72B 'linux':1A,21B,30B,81C 'linux-kernel':20B 'local':74B 'lock':130C,180C 'lookup':37B,238C,247C 'lookupat':243C 'memori':78B 'mode':124C 'need':344C 'newfstatat':260C 'noprof':281C 'noth':126C 'one':313C 'path':36B,242C 'pathwalk':123C,196C 'period':98C,166C,173C,348C 'point':114C 'process':312C 'rcu':40B,96C,122C,128C,178C,336C,355C 'read':42B,76B,103C,129C,179C,186C,221C 'refer':147C 'releas':13A,144C,158C,332C 'resolv':88C 'revalid':10A,102C,118C,202C,218C,235C 'run':38B 'section':181C 'self':25B 'self-host':24B 'size':223C 'slab':62B,211C 'slab-use-after-fre':61B,210C 'sourc':57B 'srcu':169C,171C,307C,327C,346C,358C 'statx':251C 'stay':135C 'sys':259C 'syscal':264C,269C 'task':229C,277C,302C 'thread':318C 'torn':54B 'trace':27B,232C,294C 'tracef':3A,100C,142C,200C,216C,233C 'tracefs/eventfs':33B 'use':5A,63B,212C,326C,334C 'use-after-fre':4A 'user':75B 'vfs':250C,254C 'vulner':85C 'wait':176C,349C 'walker':140C,184C,340C 'walker/97':230C 'work':314C 'worker':317C 'x10e/0x5e0':267C 'x160/0xb00':245C 'x1db/0x5b0':306C 'x1f1/0x5b0':249C 'x249/0x560':283C 'x2fb/0xcf0':293C 'x320/0x640':241C 'x3a3/0x620':311C 'x4d/0x90':257C 'x4f1/0xd60':320C 'x76/0x90':220C,237C 'x77/0x7f':274C 'x7a/0x590':288C 'x937/0x1810':316C 'xa0/0x100':262C 'xbf/0x150':299C 'xd7/0x3b0':253C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with eventfs and tracefs in use, typically hosts where ftrace or tracing is mounted. The sources do not say whether unprivileged users can trigger it, and tracefs is usually only mounted on machines that use kernel tracing. Machines without tracefs mounted are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99173","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99173","severity":null,"published_at":"2026-10-28T11:17:37+00:00","modified_at":"2026-10-28T11:17:37+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}