Use-After-Free Vulnerability in Linux Kernel Affecting Audit Rules

CVE-2026-98862

What is CVE-2026-98862?

A vulnerability exists in the Linux kernel's audit subsystem that may result in a use-after-free condition. This issue arises when the kill_rules() function attempts to remove mixed AUDIT_DIR and AUDIT_EXE rules from an audit tree. If a rule has been installed with AUDIT_ADD_RULE, the removal of the watched directory can conflict with another task that is still assessing the rule. As a consequence, the fsnotify can free the executable mark before it can be compared in audit_mark_compare(), leading to a use-after-free scenario. Proper patching involves unlinking published rules from RCU-visible lists and ensuring rules with executable marks are managed correctly to prevent such race conditions.

References