Executive brief
The Linux kernel's fanotify event notification subsystem contains a use-after-free vulnerability in its handling of file range information during permission events. An attacker with local access could exploit this flaw by interrupting a task while a fanotify reader is processing events, causing the reader to dereference freed memory and potentially leak sensitive stack data or crash the kernel.
Technical details
The vulnerability is a use-after-free in the fanotify subsystem's permission event handling. When fsnotify_pre_content() builds a file_range structure on the triggering task's stack, fanotify_alloc_perm_event() stores a pointer to the stack-allocated range position in a heap-allocated permission event. If a signal interrupts the triggering task while the event reader is processing it (after setting state to FAN_EVENT_REPORTED), the stack frame unwinds while the reader still holds the event. The reader then dereferences the stale pointer and copies arbitrary stack data to userspace via copy_range_info_to_user(). The fix changes the permission event to store the range position value directly rather than a pointer, eliminating the use-after-free. KASAN reported the issue occurring in fanotify_read(). A patch has been released and integrated into the stable kernel trees.
Affected products
- Linux Linux kernel 5.13 and later (until patched with commit d7f1cf5be33ef0175a4e8ed8687aeb98fb00a851)
Timeline
- 2026-09-11: disclosed: CVE-2026-89600 published
- 2026-09-07: patched: Fix merged by Greg Kroah-Hartman into stable trees