CVE-2026-89643 - Vulnerability Details

- audit: avoid dropping live tree ref on fsnotify rule autoremove

Description

In the Linux kernel, the following vulnerability has been resolved:

audit: avoid dropping live tree ref on fsnotify rule autoremove

audit_del_rule() is used for both netlink deletion templates and internal
fsnotify autoremove. The former passes a parsed template which owns a
temporary tree reference; the latter passes the installed entry itself.

The unconditional audit_put_tree() at the end of audit_del_rule() assumes
the template case. For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify
autoremove event therefore drops the installed rule's live tree reference.
Repeating this across rules sharing the same tree can free the tree while
another rule still references it, and a later autoremove dereferences the
freed pathname while comparing rules.

Move the temporary-tree put to audit_rule_change(), the caller that owns
deletion templates. Keep it in the AUDIT_DEL_RULE cleanup so both
successful deletion and -ENOENT still release the parser-owned tree.

[PM: dropped unnecessary comment for line length reasons]

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel’s audit subsystem, audit_del_rule() drops a temporary tree reference during filesystem notification autoremove. The unconditional audit_put_tree() call assumes a template case, but for rules that mix AUDIT_DIR and AUDIT_EXE types, the autoremove removes the live tree reference. Repeated autoremove events can free a tree that other audit rules still reference that can corrupt memory and potentially crash the kernel. This weakness is classified as CWE‑825.

Affected Systems

All Linux kernel packages that include the unpatched audit framework code before the patch backports or patches beyond the commit itself are affected.

Risk and Exploitability

The CVSS score of 9.8 classifies this flaw as critical. The EPSS score of under 1% indicates a low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is a local or privileged user who can add or remove audit rules. Repeatedly deleting mixed AUDIT_DIR and AUDIT_EXE rules can trigger the use‑after‑free, potentially causing a kernel crash or memory corruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< 9cac21f8eb82675ed19fb955b8bbb9dd14cc3d58
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< b322cc7adcd2e6ec1594d187533a126506ab545c
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< 695c85dc345a4e0292739f004c261bedef3f27e6
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< 01b0ec8c397be65ff710777c97017ca1de56ef8e
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< cf37b61b5420fd4600fe78cf8c24da6e4d9bfe28
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< 636a99bab36ba27515363d325866c0273ac83b3e
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< 583cf579b32d99e3fe4e9c8ecc4d852e3708fbec
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< 783f0f0974c156aca630f4ffff248671082a098d

Linux

affected

Version	Status	Constraints
`4.3`	affected	—
`0`	unaffected	< 4.3
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`4.3`	affected	generic	—
`[0,4.3)`	unaffected	generic	—
`[6.12.109,6.12.*]`	unaffected	generic	—
`[6.18.50,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,cf37b61b5420fd4600fe78cf8c24da6e4d9bfe28)`	affected	code_commit	—
`[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,636a99bab36ba27515363d325866c0273ac83b3e)`	affected	code_commit	—
`[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,583cf579b32d99e3fe4e9c8ecc4d852e3708fbec)`	affected	code_commit	—
`[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,783f0f0974c156aca630f4ffff248671082a098d)`	affected	code_commit	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the audit_del_rule patch from the upstream Linux repository.
Restrict audit rule modification to privileged administrators only and enforce role‑based access control for audit configuration changes.
Reconfigure audit to avoid mixing AUDIT_DIR and AUDIT_EXE rules in the same rule set, or remove such rule sets if they are not required.

Generated by OpenCVE AI on September 15, 2026 at 21:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00755.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/01b0ec8c397be65ff710777c97017ca1de56ef8e
https://git.kernel.org/stable/c/583cf579b32d99e3fe4e9c8ecc4d852e3708fbec
https://git.kernel.org/stable/c/636a99bab36ba27515363d325866c0273ac83b3e
https://git.kernel.org/stable/c/695c85dc345a4e0292739f004c261bedef3f27e6
https://git.kernel.org/stable/c/783f0f0974c156aca630f4ffff248671082a098d
https://git.kernel.org/stable/c/9cac21f8eb82675ed19fb955b8bbb9dd14cc3d58
https://git.kernel.org/stable/c/b322cc7adcd2e6ec1594d187533a126506ab545c
https://git.kernel.org/stable/c/cf37b61b5420fd4600fe78cf8c24da6e4d9bfe28
https://nvd.nist.gov/vuln/detail/CVE-2026-89643
https://www.cve.org/CVERecord?id=CVE-2026-89643

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/01b0ec8c397be65ff710777c97017ca1de56ef8e https://git.kernel.org/stable/c/695c85dc345a4e0292739f004c261bedef3f27e6 https://git.kernel.org/stable/c/9cac21f8eb82675ed19fb955b8bbb9dd14cc3d58 https://git.kernel.org/stable/c/b322cc7adcd2e6ec1594d187533a126506ab545c

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89643 https://www.cve.org/CVERecord?id=CVE-2026-89643
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove audit_del_rule() is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference; the latter passes the installed entry itself. The unconditional audit_put_tree() at the end of audit_del_rule() assumes the template case. For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify autoremove event therefore drops the installed rule's live tree reference. Repeating this across rules sharing the same tree can free the tree while another rule still references it, and a later autoremove dereferences the freed pathname while comparing rules. Move the temporary-tree put to audit_rule_change(), the caller that owns deletion templates. Keep it in the AUDIT_DEL_RULE cleanup so both successful deletion and -ENOENT still release the parser-owned tree. [PM: dropped unnecessary comment for line length reasons]
Title		audit: avoid dropping live tree ref on fsnotify rule autoremove
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/583cf579b32d99e3fe4e9c8ecc4d852e3708fbec https://git.kernel.org/stable/c/636a99bab36ba27515363d325866c0273ac83b3e https://git.kernel.org/stable/c/783f0f0974c156aca630f4ffff248671082a098d https://git.kernel.org/stable/c/cf37b61b5420fd4600fe78cf8c24da6e4d9bfe28

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:45:35.523Z

Updated: 2026-09-14T12:01:43.871Z

Reserved: 2026-09-11T19:38:34.741Z

Link: CVE-2026-89643

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:50.090

Modified: 2026-09-14T13:19:17.080

Link: CVE-2026-89643

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:45:35Z

Links: CVE-2026-89643 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T21:30:16Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object