Executive brief
The Linux kernel's audit subsystem can deadlock when processing file rename operations that trigger executable audit rules. This causes the system to hang during normal file operations, disrupting service availability and potentially leading to denial of service.
Technical details
A recursive locking deadlock occurs in audit_dupe_exe() when the audit subsystem attempts to duplicate executable-related audit rules during file move operations. The VFS layer locks the parent directory (I_MUTEX_PARENT) during do_renameat2(), which triggers an fsnotify_move event. If a matching executable audit rule exists, audit_dupe_exe() calls audit_alloc_mark() to resolve the path via kern_path_parent(), attempting to acquire the same I_MUTEX_PARENT lock already held by the task. The fix introduces struct audit_watch_ctx to pass fsnotify event context down to audit_alloc_mark(), reusing the already-resolved directory inode instead of attempting another path resolution. This eliminates the recursive lock acquisition and is applicable to all Linux kernel versions with the affected audit code.
Affected products
- Linux Linux Kernel <UNKNOWN>
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Fix introduced via struct audit_watch_ctx to prevent recursive locking