CVE-2026-89600

fanotify: fix use-after-free of file range info

Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

fanotify: fix use-after-free of file range info

fsnotify_pre_content() builds its file_range on the triggering task's
stack. fanotify_alloc_perm_event() saves a pointer to range.pos in the
heap-allocated permission event so copy_range_info_to_user() can report
the offset later.

The event reader can set the event state to FAN_EVENT_REPORTED and then
sleep while preparing the file descriptor. If a signal interrupts the
triggering task at that point, fanotify_get_response() changes the state
to FAN_EVENT_CANCELED and returns. This unwinds the file_range stack
frame while the reader still owns the event. The reader then dereferences
pevent->ppos and copies the stale stack value to userspace.

KASAN reported:

BUG: KASAN: use-after-free in fanotify_read+0x293e/0x2970
Read of size 8 at addr ffff88811434fc50 by task fanotify_inotif/95
Call Trace:
fanotify_read+0x293e/0x2970
vfs_read+0x177/0xa20
ksys_read+0xf7/0x1c0
do_syscall_64+0xf9/0x540
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Store the range position directly in the permission event and use
FANOTIFY_NO_RANGE when range information is unavailable. The event remains
alive until the reader finishes, so the reported offset no longer depends
on the triggering task's stack.

Analysis

Technical impact

The defect occurs when a fanotify permission event carries a pointer to a file range structure allocated on the triggering task's stack. If the task receives a signal and the event is cancelled before the file range is unwound. The reader then dereferences the stale pointer and copies invalid data, potentially causing a crash.

Affected Systems

All Linux kernel configurations that enable the generic fanotify subsystem are affected. The patch is included in recent kernel releases, so any kernel built before the fix is potentially vulnerable. Distributions that have not yet incorporated the fix into their packaged kernels remain at risk.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. EPSS score is below 1% and the vulnerability is not listed in CISA's KEV catalog, suggesting low exploitation probability. Based on the description, it is inferred that an attacker who can control signals to a target process might trigger the stale read, potentially causing a crash.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`870499bc1d4dc04cba1f63dd5e7bc02b983e2458`	affected	< 66aa9a9e6481bfa512ee5b6380eaaec455a954d2
`870499bc1d4dc04cba1f63dd5e7bc02b983e2458`	affected	< b8f73b163b646bc56d4dce9c697a578e333f4894
`870499bc1d4dc04cba1f63dd5e7bc02b983e2458`	affected	< d7f1cf5be33ef0175a4e8ed8687aeb98fb00a851

Linux

affected

Version	Status	Constraints
`6.14`	affected	—
`0`	unaffected	< 6.14
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[870499bc1d4dc04cba1f63dd5e7bc02b983e2458,66aa9a9e6481bfa512ee5b6380eaaec455a954d2)`	affected	code_commit	—
`[870499bc1d4dc04cba1f63dd5e7bc02b983e2458,b8f73b163b646bc56d4dce9c697a578e333f4894)`	affected	code_commit	—
`[870499bc1d4dc04cba1f63dd5e7bc02b983e2458,d7f1cf5be33ef0175a4e8ed8687aeb98fb00a851)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.14`	affected	generic	—
`[0,6.14)`	unaffected	generic	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to the latest release that contains the fanotify use‑after‑free fix
If an upgrade is not feasible, disable the fanotify subsystem by adding to the boot command line or by recompiling the kernel without fanotify support
Restrict fanotify usage to that prevent untrusted applications from invoking fanotify system calls

Generated by OpenCVE AI on September 15, 2026 at 21:28 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.124% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/66aa9a9e6481bfa512ee5b6380eaaec455a954d2
https://git.kernel.org/stable/c/b8f73b163b646bc56d4dce9c697a578e333f4894
https://git.kernel.org/stable/c/d7f1cf5be33ef0175a4e8ed8687aeb98fb00a851
https://nvd.nist.gov/vuln/detail/CVE-2026-89600
https://www.cve.org/CVERecord?id=CVE-2026-89600

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89600 https://www.cve.org/CVERecord?id=CVE-2026-89600
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotify_pre_content() builds its file_range on the triggering task's stack. fanotify_alloc_perm_event() saves a pointer to range.pos in the heap-allocated permission event so copy_range_info_to_user() can report the offset later. The event reader can set the event state to FAN_EVENT_REPORTED and then sleep while preparing the file descriptor. If a signal interrupts the triggering task at that point, fanotify_get_response() changes the state to FAN_EVENT_CANCELED and returns. This unwinds the file_range stack frame while the reader still owns the event. The reader then dereferences pevent->ppos and copies the stale stack value to userspace. KASAN reported: BUG: KASAN: use-after-free in fanotify_read+0x293e/0x2970 Read of size 8 at addr ffff88811434fc50 by task fanotify_inotif/95 Call Trace: fanotify_read+0x293e/0x2970 vfs_read+0x177/0xa20 ksys_read+0xf7/0x1c0 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f Store the range position directly in the permission event and use FANOTIFY_NO_RANGE when range information is unavailable. The event remains alive until the reader finishes, so the reported offset no longer depends on the triggering task's stack.
Title		fanotify: fix use-after-free of file range info
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/66aa9a9e6481bfa512ee5b6380eaaec455a954d2 https://git.kernel.org/stable/c/b8f73b163b646bc56d4dce9c697a578e333f4894 https://git.kernel.org/stable/c/d7f1cf5be33ef0175a4e8ed8687aeb98fb00a851