Linux kernel audit: UAF in kill_rules() due to EXE mark race
CVE-2026-98862 Published on October 18, 2026
audit: fix exe mark UAF in kill_rules()
In the Linux kernel, the following vulnerability has been resolved:
audit: fix exe mark UAF in kill_rules()
kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit
tree is pruned. It drops entry->rule.exe before removing the rule from
the RCU-visible filter lists.
After a rule has been installed with AUDIT_ADD_RULE, which requires
CAP_AUDIT_CONTROL, removing the watched directory can race with another
task that is still evaluating the rule. In that case, fsnotify can free
the executable mark before the reader reaches audit_mark_compare(),
causing a use-after-free.
KASAN reports:
BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0
Unlink the published rules from the RCU-visible lists and retain them
on tree->rules for cleanup. If any rule has an executable mark, wait for
a single RCU grace period before removing the marks and scheduling the
entries for freeing. Otherwise, call_rcu() already provides the required
deferred freeing without a synchronous wait.
Products Associated with CVE-2026-98862
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 34d99af52ad40bd498ba66970579a5bc1fb1a3bc and below 304960900991157e6883bdf0b39782b690545ee8 is affected.
- Version 34d99af52ad40bd498ba66970579a5bc1fb1a3bc and below 88633025f20ba9c32ccdb3efc86eafdf98cb825c is affected.
- Version 34d99af52ad40bd498ba66970579a5bc1fb1a3bc and below f2cc5462b78559c7628a9f8ac9a9592e7783183a is affected.
- Version 34d99af52ad40bd498ba66970579a5bc1fb1a3bc and below aa650d87a498844060eecb1d336f4d46f4d1b0b3 is affected.
- Version 4.3 is affected.
- Before 4.3 is unaffected.
- Version 6.12.113, <= 6.12.* is unaffected.
- Version 6.18.56, <= 6.18.* is unaffected.
- Version 7.2.10, <= 7.2.* is unaffected.
- Version 7.3-rc6, <= * is unaffected.