Linux kernel: Use-after-free in eventfs/tracefs during RCU path walk
Summary
A use-after-free in the Linux kernel's eventfs component (tracefs) allows a local user to trigger a read of freed kernel memory during RCU path walk. The freed object is released before all RCU readers finish, which can crash the host or corrupt kernel memory. Exploitation requires a local account or code execution on the system; privilege escalation is not confirmed by the sources.
Affected
- Linux kernel 6.6.46 to before 6.6.161 (stable branch)
- Linux kernel 6.10.5 to before 6.11
- Linux kernel 6.11 and later, until the fixed stable releases listed below
- Exact ranges per distribution kernel: Unknown.
Fixed in
- Linux kernel 6.6.161 and later (6.6 branch)
- Linux kernel 6.12.115 and later (6.12 branch)
- Linux kernel 6.18.59 and later (6.18 branch)
- Linux kernel 7.2.13 and later (7.2 branch)
- Mainline first fixed release: Unknown.
Workaround
- No vendor workaround found.
- Limit local shell and untrusted local code access on multi-user hosts until patched.
Exploitation
- No known exploitation in the wild.
- No public proof of concept found.
- The KASAN report in the description is a bug report, not exploit code.
Our recommendation
- Identify hosts running affected kernels, especially multi-user servers, shared hosts, CI runners and container hosts running untrusted code.
- Apply the distribution kernel update through the normal update cycle, with higher priority on shared systems.
- Reboot after the kernel update.
- Monitor for kernel crashes (KASAN or oops messages) on affected hosts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 2cd88c498ecff8e22bf4c397b8eb226db70ac343 git.kernel.org
- Linux stable commit 4586ef24ce390e8becb9f3e5852d5d3978b01c33 git.kernel.org
- Linux stable commit 45fcfd5d9c10e0aa977ed5b9bd445707e01bb107 git.kernel.org
- Linux stable commit 5819018dc29fb2ac2fd4865d507f9893c89c0624 git.kernel.org
- Linux stable commit dd2c767814a876be0f16f0b7f98a403dc176f51e git.kernel.org
- Ubuntu security notice CVE-2026-99173 ubuntu.com
- Vulners OSV record OSV:DEBIAN-CVE-2026-99173 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:00.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its reference to the eventfs_inode when the dentry is killed, and release_ei() then frees it after a grace period of eventfs_srcu. An SRCU grace period doesn't wait for rcu_read_lock() sections, so the walker can read an eventfs_inode that is already gone. With a pathwalk held up in tracefs_d_revalidate() while the dentry goes away: BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90 Read of size 1 at addr ff1100010152d8d0 by task walker/97 Call Trace: <TASK> tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] Allocated by task 1: __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0 trace_add_event_call+0xbf/0x150 [...] Freed by task 11: kfree+0x1db/0x5b0 srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 Before commit 8e556432477e ("eventfs: Use SRCU for freeing eventfs_inodes") release_ei() used call_rcu(), which covered the walker, while eventfs_iterate() needs the SRCU grace period. Wait for both and chain call_rcu() from the SRCU callback.
NVD references (5)
- https://git.kernel.org/stable/c/2cd88c498ecff8e22bf4c397b8eb226db70ac343
- https://git.kernel.org/stable/c/4586ef24ce390e8becb9f3e5852d5d3978b01c33
- https://git.kernel.org/stable/c/45fcfd5d9c10e0aa977ed5b9bd445707e01bb107
- https://git.kernel.org/stable/c/5819018dc29fb2ac2fd4865d507f9893c89c0624
- https://git.kernel.org/stable/c/dd2c767814a876be0f16f0b7f98a403dc176f51e
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.