CVE-2026-89618

eventfs: Initialize ei->children and ei->list in init_ei()

N/A
Published: September 11, 2026 at 07:45 PM UTC
Updated: October 19, 2026 at 09:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei->children and ei->list in init_ei() eventfs_create_dir() allocates the eventfs_inode and initializes it with init_ei(). But this does not initialize the eventfs_inode list_heads. If the eventfs_create_dir() fails due to memory pressure, it will call free_ei() before it initialized the lists, and that checks to make sure the eventfs_inode has no children. But because the list wasn't initialized, it will give a false warning. Fix it by moving the list initialization into init_ei(). [ Rewrote change log ]

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

35ee34c0f6d578c9d245438ca29bf2e7024a5a655790b1fb3d672d9a1fe3881a7181dfdbe741568f6.6.186.7
Vendor states this is fixed in 069729282fbecfaa8a54062266c338ed23f08005 (fixed)
Vendor states this is fixed in 1704aaaf5d22bc765c168402350d191e24e245bc (fixed)
Vendor states this is fixed in 5333e18e6b425fcc39c7fea89e3949a2a98bc5e4 (fixed)
Vendor states this is fixed in 76e0f85f650738d768449dbccbc7c55d05f5b609 (fixed)
Vendor states this is fixed in c480f8af173d5b19c6d9c4311df6bbe352face9e (fixed)
Vendor states this is fixed in 6.12.109 (unaffected)
Vendor states this is fixed in 6.18.50 (unaffected)
Vendor states this is fixed in 6.6.157 (unaffected)
Vendor states this is fixed in 6.7 (unaffected)
Vendor states this is fixed in 7.2.4 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card