CVE-2026-89618

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Initialize ei->children and ei->list in init_ei()

eventfs_create_dir() allocates the eventfs_inode and initializes it with

init_ei(). But this does not initialize the eventfs_inode list_heads. If

the eventfs_create_dir() fails due to memory pressure, it will call

free_ei() before it initialized the lists, and that checks to make sure

the eventfs_inode has no children. But because the list wasn't

initialized, it will give a false warning.

Fix it by moving the list initialization into init_ei().

[ Rewrote change log ]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References