Description
In the Linux kernel, the following vulnerability has been resolved:

fanotify: fix use-after-free of file range info

fsnotify_pre_content() builds its file_range on the triggering task's
stack. fanotify_alloc_perm_event() saves a pointer to range.pos in the
heap-allocated permission event so copy_range_info_to_user() can report
the offset later.

The event reader can set the event state to FAN_EVENT_REPORTED and then
sleep while preparing the file descriptor. If a signal interrupts the
triggering task at that point, fanotify_get_response() changes the state
to FAN_EVENT_CANCELED and returns. This unwinds the file_range stack
frame while the reader still owns the event. The reader then dereferences
pevent->ppos and copies the stale stack value to userspace.

KASAN reported:

BUG: KASAN: use-after-free in fanotify_read+0x293e/0x2970
Read of size 8 at addr ffff88811434fc50 by task fanotify_inotif/95
Call Trace:
fanotify_read+0x293e/0x2970
vfs_read+0x177/0xa20
ksys_read+0xf7/0x1c0
do_syscall_64+0xf9/0x540
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Store the range position directly in the permission event and use
FANOTIFY_NO_RANGE when range information is unavailable. The event remains
alive until the reader finishes, so the reported offset no longer depends
on the triggering task's stack.
Published: 2026-09-11
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Use‑After‑Free in Linux kernel fanotify may lead to process crashes
Action: Patch Now
AI Analysis

Impact

The defect occurs when a fanotify permission event carries a pointer to a file range structure allocated on the triggering task's stack. If the task receives a signal and the event is cancelled before the event reader finishes, the stack frame holding the file range is unwound. The reader then dereferences the stale pointer and copies invalid data, potentially causing a crash.

Affected Systems

All Linux kernel configurations that enable the generic fanotify subsystem are affected. The patch is included in recent kernel releases, so any kernel built before the fix is potentially vulnerable. Distributions that have not yet incorporated the fix into their packaged kernels remain at risk.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS score is below 1% and the vulnerability is not listed in CISA's KEV catalog, suggesting low exploitation probability. Based on the description, it is inferred that an attacker who can control signals to a target process might trigger the stale read, potentially causing a crash.

Generated by OpenCVE AI on September 13, 2026 at 04:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the kernel to the latest release that contains the fanotify use‑after‑free fix
  • If an upgrade is not feasible, disable the fanotify subsystem by adding the kernel parameter 'no_fanotify' to the boot command line or by recompiling the kernel without fanotify support
  • Restrict fanotify usage to trusted processes or implement SELinux/AppArmor policies that prevent untrusted applications from invoking fanotify system calls

Generated by OpenCVE AI on September 13, 2026 at 04:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 13 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H'}

threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotify_pre_content() builds its file_range on the triggering task's stack. fanotify_alloc_perm_event() saves a pointer to range.pos in the heap-allocated permission event so copy_range_info_to_user() can report the offset later. The event reader can set the event state to FAN_EVENT_REPORTED and then sleep while preparing the file descriptor. If a signal interrupts the triggering task at that point, fanotify_get_response() changes the state to FAN_EVENT_CANCELED and returns. This unwinds the file_range stack frame while the reader still owns the event. The reader then dereferences pevent->ppos and copies the stale stack value to userspace. KASAN reported: BUG: KASAN: use-after-free in fanotify_read+0x293e/0x2970 Read of size 8 at addr ffff88811434fc50 by task fanotify_inotif/95 Call Trace: fanotify_read+0x293e/0x2970 vfs_read+0x177/0xa20 ksys_read+0xf7/0x1c0 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f Store the range position directly in the permission event and use FANOTIFY_NO_RANGE when range information is unavailable. The event remains alive until the reader finishes, so the reported offset no longer depends on the triggering task's stack.
Title fanotify: fix use-after-free of file range info
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-13T06:31:32.178Z

Reserved: 2026-09-11T19:38:34.732Z

Link: CVE-2026-89600

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:44.870

Modified: 2026-09-13T07:17:25.393

Link: CVE-2026-89600

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:45:03Z

Links: CVE-2026-89600 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T04:45:18Z

Weaknesses
  • CWE-825

    Expired Pointer Dereference