In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei->children and ei->list in init_ei() eventfs_create_dir() allocates the eventfs_inode and initializes it with init_ei(). But this does not initialize the eventfs_inode list_heads. If the eventfs_create_dir() fails due to memory pressure, it will call free_ei() before it initialized the lists, and that checks to make sure the eventfs_inode has no children. But because the list wasn't initialized, it will give a false warning. Fix it by moving the list initialization into init_ei(). [ Rewrote change log ]

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei->children and
    ei->list in init_ei() eventfs_create_dir() allocates the eventfs_inode and initializes it with init_ei().
    But this does not initialize the eventfs_inode list_heads. If the eventfs_create_dir() fails due to memory
    pressure, it will call free_ei() before it initialized the lists, and that checks to make sure the
    eventfs_inode has no children. But because the list wasn't initialized, it will give a false warning. Fix
    it by moving the list initialization into init_ei(). [ Rewrote change log ] (CVE-2026-89618)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - eventfs: Initialize ei->children and ei->list in init_ei() eventfs_create_dir() allocates the     eventfs_inode and initializes it with init_ei(). But this does not initialize the eventfs_inode     list_heads. If the eventfs_create_dir() fails due to memory pressure, it will call free_ei() before it     initialized the lists, and that checks to make sure the eventfs_inode has no children. But because the     list wasn't initialized, it will give a false warning. Fix it by moving the list initialization into     init_ei(). [ Rewrote change log ] (CVE-2026-89618)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
469825	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.505.8	Tenable Cloud Security	Google COS Security Checks	Local	medium
469825	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.505.8	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
345407	Linux Distros Unpatched Vulnerability : CVE-2026-89618	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-89618

medium

Tenable Plugins

high

medium

medium

high

medium