CVE-2026-89600: fanotify: fix use-after-free of file range info
In the Linux kernel, the following vulnerability has been resolved:
fanotify: fix use-after-free of file range info
fsnotifyprecontent() builds its filerange on the triggering task's stack. fanotifyallocpermevent() saves a pointer to range.pos in the heap-allocated permission event so copyrangeinfotouser() can report the offset later.
The event reader can set the event state to FANEVENTREPORTED and then sleep while preparing the file descriptor. If a signal interrupts the triggering task at that point, fanotifygetresponse() changes the state to FANEVENTCANCELED and returns. This unwinds the filerange stack frame while the reader still owns the event. The reader then dereferences pevent->ppos and copies the stale stack value to userspace.
KASAN reported:
BUG: KASAN: use-after-free in fanotifyread+0x293e/0x2970 Read of size 8 at addr ffff88811434fc50 by task fanotifyinotif/95 Call Trace: fanotifyread+0x293e/0x2970 vfsread+0x177/0xa20 ksysread+0xf7/0x1c0 dosyscall64+0xf9/0x540 entrySYSCALL64afterhwframe+0x77/0x7f
Store the range position directly in the permission event and use FANOTIFYNORANGE when range information is unavailable. The event remains alive until the reader finishes, so the reported offset no longer depends on the triggering task's stack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What circumstances are required to trigger the flaw?
A fanotify permission event must be read while the event reader is preparing the file descriptor, and the triggering task must be interrupted by a signal during that window. The interruption cancels the event and unwinds the stack frame containing the file-range information while the reader still holds the event.
How can I identify evidence of this issue?
KASAN can report a use-after-free in fanotify_read, with a read of size 8 and a call trace including fanotify_read, vfs_read, ksys_read, and do_syscall_64. The stale value is accessed when the reader dereferences the saved range-position pointer.