CVE-2026-74512

Received Received - Intake

Use-After-Free in Linux Kernel audit_del_rule

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in audit_del_rule() `audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()` before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in `audit_filter()` and `audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify mark can be freed on an independent lifetime path. This creates a use-after-free window during rule deletion. Fix this by unlinking the rule from the RCU-visible lists and invoking `synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other rule removal helpers). This ensures that all existing RCU readers have exited the critical section before any underlying resources are destroyed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74512

EUVD

EUVD-2026-59705

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's audit subsystem. It occurs when audit rules are deleted. The function audit_del_rule() removes a rule's executable path before unlinking the rule from lists visible to readers, allowing concurrent readers to still access freed memory. This creates a window where memory is accessed after it has been freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's audit subsystem and requires kernel-level detection. No direct network or system commands are provided in the context. Monitoring kernel logs for audit-related errors or crashes during rule modifications may indicate exploitation attempts.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or enable privilege escalation if exploited. Systems relying on audit rules for security monitoring could be compromised.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free issue in the Linux kernel's audit subsystem that could lead to system instability or crashes but does not inherently violate data protection or privacy requirements.

Mitigation Strategies

Apply the kernel patch that fixes the use-after-free in audit_del_rule(). Update to a patched Linux kernel version. Restart systems if necessary to ensure the updated kernel is running. Monitor for any audit subsystem crashes or errors post-update.

Hi! I’m here to help you understand CVE-2026-74512. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70