UBUNTU-CVE-2026-89600: Use After Free

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotifyprecontent() builds its filerange on the triggering task's stack. fanotifyallocpermevent() saves a pointer to range.pos in the heap-allocated permission event so copyrangeinfotouser() can report the offset later. The event reader can set the event state to FANEVENTREPORTED and then sleep while preparing the file descriptor. If a signal interrupts the triggering task at that point, fanotifygetresponse() changes the state to FANEVENTCANCELED and returns. This unwinds the filerange stack frame while the reader still owns the event. The reader then dereferences pevent->ppos and copies the stale stack value to userspace. KASAN reported: BUG: KASAN: use-after-free in fanotifyread+0x293e/0x2970 Read of size 8 at addr ffff88811434fc50 by task fanotifyinotif/95 Call Trace: fanotifyread+0x293e/0x2970 vfsread+0x177/0xa20 ksysread+0xf7/0x1c0 dosyscall64+0xf9/0x540 entrySYSCALL64afterhwframe+0x77/0x7f Store the range position directly in the permission event and use FANOTIFYNORANGE when range information is unavailable. The event remains alive until the reader finishes, so the reported offset no longer depends on the triggering task's stack.