CVE-2026-74512
Received Received - Intake

Use-After-Free in Linux Kernel audit_del_rule

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in audit_del_rule() `audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()` before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in `audit_filter()` and `audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify mark can be freed on an independent lifetime path. This creates a use-after-free window during rule deletion. Fix this by unlinking the rule from the RCU-visible lists and invoking `synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other rule removal helpers). This ensures that all existing RCU readers have exited the critical section before any underlying resources are destroyed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74512
EUVD
EUVD-2026-59705

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's audit subsystem. It occurs when audit rules are deleted. The function audit_del_rule() removes a rule's executable path before unlinking the rule from lists visible to readers, allowing concurrent readers to still access freed memory. This creates a window where memory is accessed after it has been freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's audit subsystem and requires kernel-level detection. No direct network or system commands are provided in the context. Monitoring kernel logs for audit-related errors or crashes during rule modifications may indicate exploitation attempts.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or enable privilege escalation if exploited. Systems relying on audit rules for security monitoring could be compromised.

Mitigation Strategies

Apply the kernel patch that fixes the use-after-free in audit_del_rule(). Update to a patched Linux kernel version. Restart systems if necessary to ensure the updated kernel is running. Monitor for any audit subsystem crashes or errors post-update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74512. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart