CVE-2026-98862: audit: fix exe mark UAF in kill_rules()
In the Linux kernel, the following vulnerability has been resolved:
audit: fix exe mark UAF in killrules()
killrules() removes mixed AUDITDIR and AUDITEXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists.
After a rule has been installed with AUDITADDRULE, which requires CAPAUDITCONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches auditmarkcompare(), causing a use-after-free.
KASAN reports:
BUG: KASAN: slab-use-after-free in auditmarkcompare+0x8d/0xa0
Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, callrcu() already provides the required deferred freeing without a synchronous wait.
Affected Software
Event History
Frequently Asked Questions
Who can create the rule configuration needed to trigger this issue?
Installing the affected audit rule with AUDIT_ADD_RULE requires CAP_AUDIT_CONTROL. The vulnerable scenario involves mixed AUDIT_DIR and AUDIT_EXE audit rules.
What race is required for the use-after-free to occur?
A watched directory must be removed, causing its audit tree to be pruned, while another task is still evaluating the installed rule. The executable mark can then be freed before the reader reaches audit_mark_compare().
How does the resolved code prevent the race?
It first unlinks published rules from the RCU-visible filter lists and retains them for cleanup. When a rule has an executable mark, it waits for an RCU grace period before removing marks and freeing entries.