CVE-2026-89643: audit: avoid dropping live tree ref on fsnotify rule autoremove
audit: avoid dropping live tree ref on fsnotify rule autoremove
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
Which audit rule setups are exposed to this issue?
The issue affects installed audit rules that combine AUDIT_DIR and AUDIT_EXE and share the same audit tree with other rules. It is triggered when fsnotify internally autoremoves one of those installed rules.
Does a single autoremove immediately create the use-after-free condition?
An autoremove can drop a live tree reference from the installed rule. Repeated autoremoves across rules sharing that tree can free the tree while another rule still holds a reference, allowing a later autoremove to dereference the freed pathname.
What change resolves the reference-handling problem?
The fix moves the temporary tree-reference release from audit_del_rule() to audit_rule_change(), which owns netlink deletion templates. The cleanup also retains the release for AUDIT_DEL_RULE requests that return -ENOENT.