Cloudanix VulnDB

CVE-2026-89643

Critical · 9.8

CVSS

9.8

EPSS

0.7%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in how the Linux kernel manages certain file-monitoring audit rules can let attackers crash the system or gain full control if they trigger the right sequence of events.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in audit_del_rule() caused by unconditional audit_put_tree() on fsnotify autoremove paths for mixed AUDIT_DIR plus AUDIT_EXE rules, freeing a live tree reference still held by other installed rules and later dereferencing the freed pathname during rule comparison.

Why it matters to the business

Kernel memory corruption on Linux systems can lead to crashes, denial of service, or full system compromise, disrupting operations and requiring urgent patching across server fleets with high ecosystem prevalence.

How an attack unfolds

An attacker configures audit rules combining directory and executable watches so that fsnotify autoremove events repeatedly trigger the flawed reference counting path, freeing a tree object while other rules still reference it and enabling subsequent use of the dangling pointer.

How to fix it

Apply the upstream fix that moves the temporary tree reference release from audit_del_rule() into audit_rule_change() and update all affected Linux kernels to a version containing this change.

How to confirm the fix worked

Confirm the presence of the commit that relocates audit_put_tree() handling and test that mixed AUDIT_DIR/AUDIT_EXE rules no longer produce use-after-free warnings under fsnotify autoremove workloads.

Typical attack path

  1. Deploy audit rules containing both AUDIT_DIR and AUDIT_EXE components on a vulnerable kernel
  2. Trigger fsnotify events that cause autoremove of one rule while others share the tree
  3. Force repeated autoremove operations to free the tree object
  4. Trigger a later autoremove that dereferences the now-freed pathname
  5. Leverage the resulting memory corruption for privilege escalation or denial of service

How to detect it

Inspect kernel logs for oops, panic, or KASAN reports referencing audit_del_rule, audit_put_tree, or fsnotify rule removal; correlate with processes creating or deleting audit rules involving both directory and executable filters.

What your security team should do

  • Expedite kernel upgrades on all production Linux hosts given the critical CVSS score
  • Audit existing audit rule sets for mixed DIR and EXE watches and simplify where possible
  • Enable kernel memory debugging features such as KASAN on test systems to surface latent UAF issues
  • Monitor EPSS and KEV feeds for any future increase in exploitation activity

The record

In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove audit_del_rule() is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference; the latter passes the installed entry itself. The unconditional audit_put_tree() at the end of audit_del_rule() assumes the template case. For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify autoremove event therefore drops the installed rule's live tree reference. Repeating this across rules sharing the same tree can free the tree while another rule still references it, and a later autoremove dereferences the freed pathname while comparing rules. Move the temporary-tree put to audit_rule_change(), the caller that owns deletion templates. Keep it in the AUDIT_DEL_RULE cleanup so both successful deletion and -ENOENT still release the parser-owned tree. [PM: dropped unnecessary comment for line length reasons]

Affected packages

Ecosystem Package Introduced Fixed