audit: fix exe mark UAF in kill_rules()
In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been installed with AUDIT_ADD_RULE, which requires CAP_AUDIT_CONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches audit_mark_compare(), causing a use-after-free. KASAN reports: BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0 Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call_rcu() already provides the required deferred freeing without a synchronous wait.
CVE-2026-98862
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98862
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
"lessThan": "9aee3caeff4dd4126d84f67607b95cec8719b867",
"versionType": "git"
},
{
"status": "affected",
"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
"lessThan": "304960900991157e6883bdf0b39782b690545ee8",
"versionType": "git"
},
{
"status": "affected",
"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
"lessThan": "88633025f20ba9c32ccdb3efc86eafdf98cb825c",
"versionType": "git"
},
{
"status": "affected",
"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
"lessThan": "f2cc5462b78559c7628a9f8ac9a9592e7783183a",
"versionType": "git"
},
{
"status": "affected",
"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
"lessThan": "aa650d87a498844060eecb1d336f4d46f4d1b0b3",
"versionType": "git"
}
],
"programFiles": [
"kernel/audit_tree.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"kernel/audit_tree.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98862
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #49013 · Revision 1
- Added to Heist Feed
- Publisher date