CVE-2026-89618

A flaw was found in the Linux kernel's eventfs component. When the eventfs_create_dir() function fails due to memory pressure, an uninitialized internal data structure can cause the system to issue a misleading warning during the cleanup process. This incorrect error reporting could lead to confusion in system diagnostics.

A low impact flaw was found in the Linux kernel's eventfs component (fs/tracefs/event_inode.c). The init_ei() helper does not initialize the eventfs_inode list_heads (ei->children and ei->list), so when eventfs_create_dir() fails under memory pressure, the cleanup path free_ei() inspects an uninitialized children list and issues a false warning claiming the inode still has children. A local user able to induce memory pressure while eventfs directories are being created could trigger this misleading kernel warning, which can confuse system diagnostics and error reporting; there is no impact on the confidentiality or integrity of data. Red Hat Enterprise Linux 10, RHIVOS 2, and OpenShift Container Platform 5 (RHCOS 9 based) are affected, while Red Hat Enterprise Linux 6, 7, 8, and 9 and OpenShift Container Platform 4 are not affected because the vulnerable code is not present in their kernels. Because this is a low-impact issue whose only consequence is an incorrect warning in an error-handling path, the fix has been deferred to a future release of the affected products; the residual risk is limited to misleading diagnostic output with no direct security consequence.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.