audit: fix exe mark UAF in kill_rules()

{
  "id": "dc1121da028299651d410708168c275c22f79dd1613a884ffb7ad9bbdeefb474",
  "url": "https://osv.dev/vulnerability/CVE-2026-98862",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "audit: fix exe mark UAF in kill_rules()",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been installed with AUDIT_ADD_RULE, which requires CAP_AUDIT_CONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches audit_mark_compare(), causing a use-after-free. KASAN reports: BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0 Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call_rcu() already provides the required deferred freeing without a synchronous wait.",
    "evidence": "osv:CVE-2026-98862",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.273",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.224",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.191",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.160",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.113",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.56",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.2.10",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-98862",
      "aliases": [
        "CVE-2026-98862"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc"
                },
                {
                  "fixed": "8d9c97fb262067933ff4452db19e692d26622352"
                },
                {
                  "fixed": "11715656540360906235d724fde5349631425073"
                },
                {
                  "fixed": "0afb9202c1fb88387d0577524bf9785664bdd802"
                },
                {
                  "fixed": "9aee3caeff4dd4126d84f67607b95cec8719b867"
                },
                {
                  "fixed": "304960900991157e6883bdf0b39782b690545ee8"
                },
                {
                  "fixed": "88633025f20ba9c32ccdb3efc86eafdf98cb825c"
                },
                {
                  "fixed": "f2cc5462b78559c7628a9f8ac9a9592e7783183a"
                },
                {
                  "fixed": "aa650d87a498844060eecb1d336f4d46f4d1b0b3"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98862.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.3.0"
                },
                {
                  "fixed": "5.10.273"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.224"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.191"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.160"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.113"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.56"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.2.10"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98862.json"
          }
        }
      ],
      "modified": "2026-11-01T02:31:05.392256932Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/0afb9202c1fb88387d0577524bf9785664bdd802",
        "https://git.kernel.org/stable/c/11715656540360906235d724fde5349631425073",
        "https://git.kernel.org/stable/c/304960900991157e6883bdf0b39782b690545ee8",
        "https://git.kernel.org/stable/c/88633025f20ba9c32ccdb3efc86eafdf98cb825c",
        "https://git.kernel.org/stable/c/8d9c97fb262067933ff4452db19e692d26622352",
        "https://git.kernel.org/stable/c/9aee3caeff4dd4126d84f67607b95cec8719b867",
        "https://git.kernel.org/stable/c/aa650d87a498844060eecb1d336f4d46f4d1b0b3",
        "https://git.kernel.org/stable/c/f2cc5462b78559c7628a9f8ac9a9592e7783183a",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98862.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-98862",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98862.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-98862",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 512491,
  "published_at": "2026-10-18T15:51:23.224+00:00"
}