The Linux kernel audit subsystem contains a flaw where the function audit_del_rule() incorrectly manages a temporary tree reference during filesystem notification autoremove. When audit rules that mix AUDIT_DIR and AUDIT_EXE types are automatically removed, the live tree reference of an installed rule is dropped prematurely. Repeated autoremove operations can free memory that remains in use by remaining rules, leading to a use‑after‑free condition that may corrupt memory or cause a crash. The weakness is classified as CWE‑825, indicating improper handling of dynamic references and resulting in an inconsistent system state.

All Linux kernel builds that incorporate the audit framework code before the patch referenced in the advisory are affected. The that ship the upstream kernel without applying the indicated commit. No specific version ranges are listed, so the safest assumption is that any Linux kernel built from source that contains the unpatched audit module is vulnerable.

The CVSS score of 5.7 places this issue in the medium severity range. The EPSS score of < 1% and the fact that the vulnerability is not listed in CISA KEV suggest that it is not a widely exploited or actively targeted flaw at this time. The likely attack vector is a local user or privileged process that can manipulate audit rules or trigger filesystem notifications. An attacker who can create and then delete audit rules with mixed AUDIT_DIR and AUDIT_EXE types could induce the double‑ could allow privilege escalation or denial of service. Because the condition requires control over audit rule configuration, the risk is higher only for systems where audit configuration is delegated or exposed to untrusted users.