CVE-2026-99173

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Free the eventfs inode after an rcu grace period too

tracefs d revalidate() reads ->is freed of the eventfs inode that dentry->d fsdata points to, and ->d revalidate() is called in rcu pathwalk mode with nothing but rcu read lock() held. The dentry itself stays around for such a walker, but tracefs d release() drops its reference to the eventfs inode when the dentry is killed, and release ei() then frees it after a grace period of eventfs srcu. An SRCU grace period doesn't wait for rcu read lock() sections, so the walker can read an eventfs inode that is already gone.

With a pathwalk held up in tracefs d revalidate() while the dentry goes away:

BUG: KASAN: slab-use-after-free in tracefs d revalidate+0x76/0x90 Read of size 1 at addr ff1100010152d8d0 by task walker/97 Call Trace: tracefs d revalidate+0x76/0x90 lookup fast+0x320/0x640 path lookupat+0x160/0xb00 filename lookup+0x1f1/0x5b0 vfs statx+0xd7/0x3b0 vfs fstatat+0x4d/0x90 do sys newfstatat+0xa0/0x100 do syscall 64+0x10e/0x5e0 entry SYSCALL 64 after hwframe+0x77/0x7f [...] Allocated by task 1: kmalloc cache noprof+0x249/0x560 eventfs create dir+0x7a/0x590 event create dir+0x2fb/0xcf0 trace add event call+0xbf/0x150 [...] Freed by task 11: kfree+0x1db/0x5b0 srcu invoke callbacks+0x3a3/0x620 process one work+0x937/0x1810 worker thread+0x4f1/0xd60

Before commit 8e556432477e ("eventfs: Use SRCU for freeing eventfs inodes") release ei() used call rcu(), which covered the walker, while eventfs iterate() needs the SRCU grace period. Wait for both and chain call rcu() from the SRCU callback.