The Linux kernel’s eventfs subsystem frees its inode at an inappropriate time when an SRCU grace period ends, before all readers have finished. A pathwalk that calls tracefs_d_revalidate() can read an inode that has already been freed, causing a slab use‑after‑free. This kernel memory corruption can be leveraged by an attacker to execute malicious code with kernel privileges or to crash the system, depending on the context in which the faulty inode is accessed.

All Linux kernels before the commit that introduced the SRCU‑based fix (8e556432477e) are affected. This includes every distribution’s kernel whose build predates that change – essentially all stock kernels distributed before the patch was released.

The vulnerability can be triggered through standard file‑system operations such as statx or fstatat that walk the tracefs path. Since it relies on a kernel internal race, an attacker with the ability to invoke those calls (a normal user) can trigger the use‑after‑free. The severity is high, EPSS is not available, but the bug is not listed in CISA KEV, indicating no public exploitation yet. Still, the combination of a kernel bug and broad user‑triggerable API warrants a high risk rating and a likely attack vector that does not require elevated privileges.