Live › vulnerability › CVE-2026-98862
Go to dashboardWhen a watched audit directory is removed, the kernel can free an executable mark while another task is still evaluating the audit rule, causing a use-after-free. The sources do not say what an attacker gets beyond the memory corruption itself.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running the Linux kernel with audit rules that combine directory watches (AUDIT_DIR) and executable filters (AUDIT_EXE), where rules are added via AUDIT_ADD_RULE by a CAP_AUDIT_CONTROL holder. Systems without audit rules of that form are unlikely to be exposed, but the sources do not confirm the exact trigger conditions.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel version, which the sources do not name-F exe= combined with directory watches (auditctl -l)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
audit: fix exe mark UAF in kill_rules()
kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists.
After a rule has been installed with AUDIT_ADD_RULE, which requires CAP_AUDIT_CONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches audit_mark_compare(), causing a use-after-free.
KASAN reports:
BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0
Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call_rcu() already provides the required deferred freeing without a synchronous wait.
This page as .md · .json · in your agent: get_signal("CVE-2026-98862")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.