Executive brief
The Linux kernel's eventfs subsystem, which manages event tracing files in the kernel, had a bug where data structure lists were not properly initialized in certain code paths. If the filesystem creation process failed due to system resource constraints, the cleanup code would encounter uninitialized data and produce false warning messages, potentially masking real issues or causing confusion during system troubleshooting.
Technical details
The vulnerability is an uninitialized data structure issue (CWE-456) in the eventfs module of the Linux kernel's tracefs subsystem. The eventfs_inode structure's list_head members (ei->children and ei->list) were not initialized in the init_ei() function, but were instead initialized later in eventfs_create_dir() and eventfs_create_events_dir(). If these functions failed during execution (e.g., due to memory pressure), the error handling path would call free_ei(), which checks these list structures while they remained uninitialized, generating spurious warnings. The fix consolidates the list initialization into init_ei() to ensure proper initialization regardless of code path. This is a defensive coding fix with no direct exploitation or data exposure impact; patches are available in Linux kernel stable trees.
Affected products
- Linux Linux kernel multiple versions with eventfs support
Timeline
- 2026-09-11: disclosed: CVE-2026-89618 published
- 2026-08-24: patched: Fix committed upstream by Deepanshu Kartikey
- 2026-09-14: patched: Patch merged into stable kernel by Greg Kroah-Hartman