Description
In the Linux kernel, the following vulnerability has been resolved:

audit: fix exe mark UAF in kill_rules()

kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit
tree is pruned. It drops entry->rule.exe before removing the rule from
the RCU-visible filter lists.

After a rule has been installed with AUDIT_ADD_RULE, which requires
CAP_AUDIT_CONTROL, removing the watched directory can race with another
task that is still evaluating the rule. In that case, fsnotify can free
the executable mark before the reader reaches audit_mark_compare(),
causing a use-after-free.

KASAN reports:

BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0

Unlink the published rules from the RCU-visible lists and retain them
on tree->rules for cleanup. If any rule has an executable mark, wait for
a single RCU grace period before removing the marks and scheduling the
entries for freeing. Otherwise, call_rcu() already provides the required
deferred freeing without a synchronous wait.
Published: 2026-10-18
Score: n/a
EPSS: n/a
KEV: No
Impact: Use‑After‑Free in kernel audit rule removal potentially leading to privilege escalation
Action: Immediate Patch
AI Analysis

Impact

A race between the removal of audit rules and a task still evaluating the rule can free an executable mark before it is used, causing a use‑after‑free in audit_mark_compare. This memory corruption may allow an attacker to execute arbitrary code or corrupt kernel state.

Affected Systems

All Linux kernel installations are affected regardless of vendor, because the flaw is in the core kernel audit subsystem.

Risk and Exploitability

The CVSS score is not provided, but the deficiency is a classic use‑after‑free with potential for kernel compromises. Exploitation would require the ability to modify audit rules (CAP_AUDIT_CONTROL) and might involve a race condition that is difficult to trigger reliably. The EPSS is not available and the vulnerability is not listed in the KEV catalog, so no current public exploits are known. Nevertheless, the high potential impact warrants immediate attention.

Generated by OpenCVE AI on October 18, 2026 at 21:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a kernel update that contains the audit_mark_compare fix from the kernel commit history
  • Restrict CAP_AUDIT_CONTROL to trusted administrators to limit the creation and deletion of audit rules
  • Audit kernel logs for unusual rule removals and consider disabling audit rule pruning if not required

Generated by OpenCVE AI on October 18, 2026 at 21:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been installed with AUDIT_ADD_RULE, which requires CAP_AUDIT_CONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches audit_mark_compare(), causing a use-after-free. KASAN reports: BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0 Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call_rcu() already provides the required deferred freeing without a synchronous wait.
Title audit: fix exe mark UAF in kill_rules()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:51:23.224Z

Reserved: 2026-09-25T10:25:14.376Z

Link: CVE-2026-98862

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:40.677

Modified: 2026-10-18T16:17:40.677

Link: CVE-2026-98862

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T21:30:14Z

Weaknesses