CVE-2026-98862 - Vulnerability Details

- audit: fix exe mark UAF in kill_rules()

Description

In the Linux kernel, the following vulnerability has been resolved:

audit: fix exe mark UAF in kill_rules()

kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit
tree is pruned. It drops entry->rule.exe before removing the rule from
the RCU-visible filter lists.

After a rule has been installed with AUDIT_ADD_RULE, which requires
CAP_AUDIT_CONTROL, removing the watched directory can race with another
task that is still evaluating the rule. In that case, fsnotify can free
the executable mark before the reader reaches audit_mark_compare(),
causing a use-after-free.

KASAN reports:

BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0

Unlink the published rules from the RCU-visible lists and retain them
on tree->rules for cleanup. If any rule has an executable mark, wait for
a single RCU grace period before removing the marks and scheduling the
entries for freeing. Otherwise, call_rcu() already provides the required
deferred freeing without a synchronous wait.

Published: 2026-10-18

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race between the removal of audit rules and a task still evaluating the rule can free an executable mark before it is used, causing a use‑after‑free in audit_mark_compare. This memory corruption may allow an attacker to execute arbitrary code or corrupt kernel state. The vulnerability also represents a race condition (CWE‑825).

Affected Systems

All Linux kernel installations are affected regardless of vendor, because the flaw is in the core kernel audit subsystem.

Risk and Exploitability

The CVSS score of 4.1 indicates low severity, but the vulnerability can still lead to kernel compromise if an attacker manages to trigger the race. Exploitation requires the ability to modify audit rules (CAP_AUDIT_CONTROL) and careful timing, making it difficult to exploit reliably. The EPSS score is below 1% and the issue is not listed in the KEV catalog, so no public exploits are known, yet patching remains recommended to eliminate the potential for abuse.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< 8d9c97fb262067933ff4452db19e692d26622352
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< 11715656540360906235d724fde5349631425073
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< 0afb9202c1fb88387d0577524bf9785664bdd802
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< 9aee3caeff4dd4126d84f67607b95cec8719b867
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< 304960900991157e6883bdf0b39782b690545ee8
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< 88633025f20ba9c32ccdb3efc86eafdf98cb825c
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< f2cc5462b78559c7628a9f8ac9a9592e7783183a
`34d99af52ad40bd498ba66970579a5bc1fb1a3bc`	affected	< aa650d87a498844060eecb1d336f4d46f4d1b0b3

Linux

affected

Version	Status	Constraints
`4.3`	affected	—
`0`	unaffected	< 4.3
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,304960900991157e6883bdf0b39782b690545ee8)`	affected	code_commit	—
`[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,88633025f20ba9c32ccdb3efc86eafdf98cb825c)`	affected	code_commit	—
`[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,f2cc5462b78559c7628a9f8ac9a9592e7783183a)`	affected	code_commit	—
`[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,aa650d87a498844060eecb1d336f4d46f4d1b0b3)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.3`	affected	generic	—
`[0,4.3)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that contains the audit_mark_compare fix from the kernel commit history
Restrict CAP_AUDIT_CONTROL to trusted administrators to limit the creation and deletion of audit rules
Audit kernel logs for unusual rule removals and consider disabling audit rule pruning if not required

Generated by OpenCVE AI on October 24, 2026 at 15:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00201.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98862.mbox
https://git.kernel.org/stable/c/0afb9202c1fb88387d0577524bf9785664bdd802
https://git.kernel.org/stable/c/11715656540360906235d724fde5349631425073
https://git.kernel.org/stable/c/304960900991157e6883bdf0b39782b690545ee8
https://git.kernel.org/stable/c/88633025f20ba9c32ccdb3efc86eafdf98cb825c
https://git.kernel.org/stable/c/8d9c97fb262067933ff4452db19e692d26622352
https://git.kernel.org/stable/c/9aee3caeff4dd4126d84f67607b95cec8719b867
https://git.kernel.org/stable/c/aa650d87a498844060eecb1d336f4d46f4d1b0b3
https://git.kernel.org/stable/c/f2cc5462b78559c7628a9f8ac9a9592e7783183a
https://nvd.nist.gov/vuln/detail/CVE-2026-98862
https://www.cve.org/CVERecord?id=CVE-2026-98862

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0afb9202c1fb88387d0577524bf9785664bdd802 https://git.kernel.org/stable/c/11715656540360906235d724fde5349631425073 https://git.kernel.org/stable/c/8d9c97fb262067933ff4452db19e692d26622352

Sat, 24 Oct 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sat, 24 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98862.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98862 https://www.cve.org/CVERecord?id=CVE-2026-98862
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/9aee3caeff4dd4126d84f67607b95cec8719b867

Sun, 18 Oct 2026 21:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been installed with AUDIT_ADD_RULE, which requires CAP_AUDIT_CONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches audit_mark_compare(), causing a use-after-free. KASAN reports: BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0 Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call_rcu() already provides the required deferred freeing without a synchronous wait.
Title		audit: fix exe mark UAF in kill_rules()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/304960900991157e6883bdf0b39782b690545ee8 https://git.kernel.org/stable/c/88633025f20ba9c32ccdb3efc86eafdf98cb825c https://git.kernel.org/stable/c/aa650d87a498844060eecb1d336f4d46f4d1b0b3 https://git.kernel.org/stable/c/f2cc5462b78559c7628a9f8ac9a9592e7783183a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:51:23.224Z

Updated: 2026-10-30T12:40:19.578Z

Reserved: 2026-09-25T10:25:14.376Z

Link: CVE-2026-98862

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:40.677

Modified: 2026-10-30T13:21:31.480

Link: CVE-2026-98862

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98862 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T15:45:07Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object