CVE-2026-98862
Received Received - Intake

Use-After-Free in Linux Kernel audit Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been installed with AUDIT_ADD_RULE, which requires CAP_AUDIT_CONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches audit_mark_compare(), causing a use-after-free. KASAN reports: BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0 Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call_rcu() already provides the required deferred freeing without a synchronous wait.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98862
EUVD
EUVD-2026-103802

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 34d99af52ad40bd498ba66970579a5bc1fb1a3bc
Linux Linux 34d99af52ad40bd498ba66970579a5bc1fb1a3bc
Linux Linux 34d99af52ad40bd498ba66970579a5bc1fb1a3bc
Linux Linux 34d99af52ad40bd498ba66970579a5bc1fb1a3bc
Linux Linux 4.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's audit subsystem. It occurs when kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules during audit tree pruning. The function drops entry->rule.exe before removing the rule from RCU-visible filter lists, allowing a race condition where fsnotify frees an executable mark before audit_mark_compare() can safely access it.

Detection Guidance

This vulnerability is specific to the Linux kernel's audit subsystem and may not have direct network detection methods. Check kernel logs for KASAN reports or audit-related errors using commands like dmesg | grep -i kasan or dmesg | grep -i audit. Monitor for use-after-free crashes in audit_mark_compare.

Impact Analysis

This vulnerability could allow an attacker with CAP_AUDIT_CONTROL privileges to trigger a use-after-free condition, potentially causing kernel crashes, memory corruption, or privilege escalation. Systems relying on audit rules for security monitoring may experience instability or incorrect audit behavior.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-98862. Avoid creating or modifying audit rules with AUDIT_ADD_RULE until the kernel is updated. Restrict CAP_AUDIT_CONTROL capabilities to trusted users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98862. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart