Use-After-Free Vulnerability in Linux Kernel EventFS Component

CVE-2026-99173

What is CVE-2026-99173?

A use-after-free vulnerability exists in the Linux kernel's eventfs component. When the dentry representing an eventfs_inode is freed, it can still be accessed by tasks that are in the process of navigating the filesystem. This occurs during the execution of the tracefs_d_revalidate() function, which reads the freed inode's data under conditions where the inode may no longer exist. As a result, the system may experience unexpected behaviors or crashes when accessing the inode after it has been freed. The vulnerability has been addressed to ensure that the inode is only freed once all read operations associated with it are complete, preventing potential exploitation.

References