The vulnerability arises from a use-after‑free condition triggered when audit_del_rule destroys the rule’s executable descriptor before synchronizing with the RCU-visible lists. This allows concurrent readers in audit_filter and audit_filter_rules to dereference freed memory, creating a window where arbitrary memory corruption or a crash can occur.

The audit subsystem is part of every Linux kernel distribution. Any kernel that has not incorporated the set of patch commits (246df90b5f1a8a6e6abbd2f058b029558720adec, 45bf3df5b32e5a49953e7ceabc55f7dd85380e46, 5b8f46864f06d6dbacb7dcea52bc084dfd122638, 78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbf, cae0dfed5d307b240bff71c3cf206652d1b6f215) is potentially affected. No specific version ranges are listed, so all kernels prior to the inclusion of these commits may have the flaw.

The vulnerability has a CVSS score of 7.8, indicating high severity, and an EPSS score of <1%, suggesting the likelihood of exploitation is low. It is not yet listed in the CISA KEV catalog. The issue arises when audit_del_rule destroys the rule’s executable descriptor before RCU synchronization, allowing concurrent readers to dereference freed memory. An attacker who can manipulate audit rules could trigger memory corruption, potentially leading to a denial‑of‑service or, with elevated privileges, arbitrary code execution. The fix removes the use‑after‑free window by unlinking the rule first and calling synchronize_rcu() before freeing resources.