CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule()
In the Linux kernel, the following vulnerability has been resolved:
audit: fix potential use-after-free in auditdelrule()
auditdelrule() destroys e->rule.exe via auditremovemarkrule() before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in auditfilter() and auditfilterrules() still dereference e->rule.exe, while the fsnotify mark can be freed on an independent lifetime path. This creates a use-after-free window during rule deletion.
Fix this by unlinking the rule from the RCU-visible lists and invoking synchronizercu() before calling auditremovemarkrule() (and other rule removal helpers). This ensures that all existing RCU readers have exited the critical section before any underlying resources are destroyed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74512?
CVE-2026-74512 has a risk rating of 44.
How do I fix CVE-2026-74512?
To fix CVE-2026-74512, update the Linux kernel to the latest version where this vulnerability has been addressed.
What types of systems are affected by CVE-2026-74512?
CVE-2026-74512 affects systems running vulnerable versions of the Linux kernel.
What could happen if CVE-2026-74512 is exploited?
Exploitation of CVE-2026-74512 could lead to potential system instability or a denial-of-service condition.
Is CVE-2026-74512 a common vulnerability?
CVE-2026-74512 is a specific vulnerability in the Linux kernel that may not be common but poses serious risks if exploited.