CVE-2026-98862audit: fix exe mark UAF in kill_rules()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been installed with AUDIT_ADD_RULE, which requires CAP_AUDIT_CONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches audit_mark_compare(), causing a use-after-free. KASAN reports: BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0 Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call_rcu() already provides the required deferred freeing without a synchronous wait.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 34d99af52ad40bd498ba66970579a5bc1fb1a3bc before 304960900991157e6883bdf0b39782b690545ee8; from 34d99af52ad40bd498ba66970579a5bc1fb1a3bc before 88633025f20ba9c32ccdb3efc86eafdf98cb825c; from 34d99af52ad40bd498ba66970579a5bc1fb1a3bc before f2cc5462b78559c7628a9f8ac9a9592e7783183a; from 34d99af52ad40bd498ba66970579a5bc1fb1a3bc before aa650d87a498844060eecb1d336f4d46f4d1b0b3 | CNA record |
References
- https://git.kernel.org/stable/c/304960900991157e6883bdf0b39782b690545ee8
- https://git.kernel.org/stable/c/88633025f20ba9c32ccdb3efc86eafdf98cb825c
- https://git.kernel.org/stable/c/f2cc5462b78559c7628a9f8ac9a9592e7783183a
- https://git.kernel.org/stable/c/aa650d87a498844060eecb1d336f4d46f4d1b0b3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.