Executive brief
The Linux kernel's audit subsystem contains a use-after-free vulnerability in its audit rule deletion logic. When audit rules monitoring file system events are automatically removed, the code incorrectly releases a memory reference that is still in use by other rules, potentially allowing an attacker to crash the system or execute arbitrary code with kernel privileges.
Technical details
The vulnerability is a use-after-free in the Linux kernel's audit rule deletion mechanism. The `audit_del_rule()` function unconditionally releases a tree reference via `audit_put_tree()` at the end of execution, assuming it is operating on a temporary parser-owned reference. However, when the function is called internally during fsnotify-based automatic rule removal, the entry passed contains a live, installed rule with a reference that is still in use by the kernel. For rules mixing AUDIT_DIR and AUDIT_EXE audit types that share the same tree structure, repeated autoremoval events can prematurely free the tree data structure while other rules still hold references to it. A subsequent autoremove operation then dereferences the freed memory while comparing rules, leading to a kernel crash or potential code execution. The fix moves the temporary tree reference release to the calling function (`audit_rule_change()`) so it only affects deletion templates from userspace, not live installed rules.
Affected products
- Linux Linux kernel Multiple versions prior to fix commit 783f0f0974c156aca630f4ffff248671082a098d
Timeline
- 2026-09-11: disclosed: CVE-2026-89643 published
- 2026-09-14: patched: Fix committed to stable kernel tree via commit 01b0ec8c397be65ff710777c97017ca1de56ef8e