CVE-2026-98862

audit: fix exe mark UAF in kill_rules()

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

audit: fix exe mark UAF in kill_rules()

kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists.

After a rule has been installed with AUDIT_ADD_RULE, which requires CAP_AUDIT_CONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches audit_mark_compare(), causing a use-after-free.

KASAN reports:

BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0

Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call_rcu() already provides the required deferred freeing without a synchronous wait.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before 8d9c97fb262067933ff4452db19e692d26622352Affected 34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before 11715656540360906235d724fde5349631425073Affected 34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before 0afb9202c1fb88387d0577524bf9785664bdd802Affected 34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before 9aee3caeff4dd4126d84f67607b95cec8719b867Affected 34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before 304960900991157e6883bdf0b39782b690545ee8Affected 34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before 88633025f20ba9c32ccdb3efc86eafdf98cb825cAffected 34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before f2cc5462b78559c7628a9f8ac9a9592e7783183aAffected 34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before aa650d87a498844060eecb1d336f4d46f4d1b0b3Affected
LinuxLinux	4.3Affected before 4.3Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before 8d9c97fb262067933ff4452db19e692d26622352Affected
34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before 11715656540360906235d724fde5349631425073Affected
34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before 0afb9202c1fb88387d0577524bf9785664bdd802Affected
34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before 9aee3caeff4dd4126d84f67607b95cec8719b867Affected
34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before 304960900991157e6883bdf0b39782b690545ee8Affected
34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before 88633025f20ba9c32ccdb3efc86eafdf98cb825cAffected
34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before f2cc5462b78559c7628a9f8ac9a9592e7783183aAffected
34d99af52ad40bd498ba66970579a5bc1fb1a3bc to before aa650d87a498844060eecb1d336f4d46f4d1b0b3Affected

LinuxLinux

4.3Affected
before 4.3Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.