{"id":"CVE-2026-98534","kind":"vulnerability","aliases":["CVE-2026-98534"],"related":[],"title":"Linux kernel IPE: use-after-free when auditing a newly loaded policy","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipe: fix use-after-free when auditing a newly loaded policy\n\nnew_policy() audits the policy after ipe_new_policyfs_node() publishes it\nand drops the new directory's inode lock. A concurrent delete can free\nthe policy while ipe_audit_policy_load() is still using it.\n\nAudit the successful load under that lock.\n\n[FW: remove model name according to latest guideline]","summary":"In the Linux kernel's IPE policy code, a newly loaded policy can be freed by a concurrent delete while it is still being audited. The sources describe a use-after-free, which can crash the kernel or be turned into memory corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","self-hosted"],"not_affected_if":["ipe-disabled"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:05+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:49+00:00","updated_at":"2026-10-25T05:23:49+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:23:49Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel IPE: use-after-free when auditing a newly loaded policy","impact":"medium","summary":"In the Linux kernel's IPE policy code, a newly loaded policy can be freed by a concurrent delete while it is still being audited. The sources describe a use-after-free, which can crash the kernel or be turned into memory corruption.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel memory corruption or crash through a freed policy object","analyst_note":"Find the fixed kernel commit and affected stable versions from the NVD entry or the kernel.org stable mailing list.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["ipe-disabled"],"who_is_affected":"Systems running a Linux kernel with IPE (Integrity Policy Enforcement) enabled and policies being loaded and deleted. The sources do not say which kernel versions are affected or whether the default configuration enables IPE.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000548,"input_tokens":3363,"output_tokens":424,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98534':16A,19A 'accord':140C 'audit':9A,51B,88C,95C,122C,129C 'code':34B 'concurr':44B,114C 'corrupt':70B 'crash':62B 'cve':14A,17A 'delet':45B,115C 'describ':54B 'directori':109C 'drop':106C 'fix':82C 'follow':76C 'free':7A,59B,86C,117C 'freed':41B 'fw':136C 'guidelin':143C 'host':26B 'infrastructur':20B 'inod':111C 'ipe':3A,32B,81C,99C,121C 'kernel':2A,23B,30B,64B,74C 'latest':142C 'linux':1A,22B,29B,73C 'linux-kernel':21B 'load':12A,37B,91C,124C,132C 'lock':112C,135C 'memori':69B 'model':138C 'name':139C 'new':93C,100C,108C 'newli':11A,36B,90C 'node':102C 'polici':13A,33B,38B,92C,94C,97C,119C,123C 'policyf':101C 'publish':103C 'remov':137C 'resolv':80C 'self':25B 'self-host':24B 'sourc':53B 'still':49B,126C 'success':131C 'turn':67B 'use':5A,57B,84C,127C 'use-after-fre':4A,56B,83C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with IPE (Integrity Policy Enforcement) enabled and policies being loaded and deleted. The sources do not say which kernel versions are affected or whether the default configuration enables IPE.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98534","severity":null,"published_at":"2026-10-18T16:17:05+00:00","modified_at":"2026-10-19T10:19:08+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}