CVE-2026-99173 is a use-after-free vulnerability in the Linux kernel's eventfs subsystem. The flaw occurs because eventfs_inode objects are freed after an SRCU grace period, which does not wait for rcu_read_lock() sections, allowing a pathwalk to access freed memory. This leads to a kernel slab-use-after-free error during tracefs_d_revalidate() execution. The issue was fixed by changing the freeing mechanism to wait for both SRCU and RCU grace periods.