UBUNTU-CVE-2026-98862: Use After Free

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in killrules() killrules() removes mixed AUDITDIR and AUDITEXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been installed with AUDITADDRULE, which requires CAPAUDITCONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches auditmarkcompare(), causing a use-after-free. KASAN reports: BUG: KASAN: slab-use-after-free in auditmarkcompare+0x8d/0xa0 Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, callrcu() already provides the required deferred freeing without a synchronous wait.