All vulnerabilities
CVE-2026-98862

Linux: audit: fix exe mark UAF in kill_rules()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9aee3caeff4dd4126d84f67607b95cec8719b867Also 304960900991157e6883bdf0b39782b690545ee8, 88633025f20ba9c32ccdb3efc86eafdf98cb825cCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 9aee3caeff4dd4126d84f67607b95cec8719b867LinuxCVE List
  • 304960900991157e6883bdf0b39782b690545ee8LinuxCVE List
  • 88633025f20ba9c32ccdb3efc86eafdf98cb825cLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

audit: fix exe mark UAF in kill_rules()

kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists.

After a rule has been installed with AUDIT_ADD_RULE, which requires CAP_AUDIT_CONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches audit_mark_compare(), causing a use-after-free.

KASAN reports:

BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0

Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call_rcu() already provides the required deferred freeing without a synchronous wait.

Text from CVE List

Affected versions 12

  • Linuxaffected: 34d99af52ad40bd498ba66970579a5bc1fb1a3bc before 9aee3caeff4dd4126d84f67607b95cec8719b867CVE List
  • Linuxaffected: 34d99af52ad40bd498ba66970579a5bc1fb1a3bc before 304960900991157e6883bdf0b39782b690545ee8CVE List
  • Linuxaffected: 34d99af52ad40bd498ba66970579a5bc1fb1a3bc before 88633025f20ba9c32ccdb3efc86eafdf98cb825cCVE List
  • Linuxaffected: 34d99af52ad40bd498ba66970579a5bc1fb1a3bc before f2cc5462b78559c7628a9f8ac9a9592e7783183aCVE List
  • Linuxaffected: 34d99af52ad40bd498ba66970579a5bc1fb1a3bc before aa650d87a498844060eecb1d336f4d46f4d1b0b3CVE List
  • Linuxaffected: 4.3CVE List
  • Linuxunaffected: all versions before 4.3CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5