CVE-2026-89618
Description
A flaw was found in the Linux kernel's eventfs component. When the eventfs_create_dir() function fails due to memory pressure, an uninitialized internal data structure can cause the system to issue a misleading warning during the cleanup process. This incorrect error reporting could lead to confusion in system diagnostics.
Statement
A low impact flaw was found in the Linux kernel's eventfs component (fs/tracefs/event_inode.c). The init_ei() helper does not initialize the eventfs_inode list_heads (ei->children and ei->list), so when eventfs_create_dir() fails under memory pressure, the cleanup path free_ei() inspects an uninitialized children list and issues a false warning claiming the inode still has children. A local user able to induce memory pressure while eventfs directories are being created could trigger this misleading kernel warning, which can confuse system diagnostics and error reporting; there is no impact on the confidentiality or integrity of data. Red Hat Enterprise Linux 10, RHIVOS 2, and OpenShift Container Platform 5 (RHCOS 9 based) are affected, while Red Hat Enterprise Linux 6, 7, 8, and 9 and OpenShift Container Platform 4 are not affected because the vulnerable code is not present in their kernels. Because this is a low-impact issue whose only consequence is an incorrect warning in an error-handling path, the fix has been deferred to a future release of the affected products; the residual risk is limited to misleading diagnostic output with no direct security consequence.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
