CVE-2026-74512

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74512", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.909Z", "datePublished": "2026-08-15T12:27:33.736Z", "dateUpdated": "2026-10-16T19:05:51.743Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:38:09.879Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix potential use-after-free in audit_del_rule()\n\n`audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()`\nbefore unlinking the rule from RCU-visible filter lists and waiting for a\ngrace period. Concurrent readers in `audit_filter()` and\n`audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify\nmark can be freed on an independent lifetime path. This creates a\nuse-after-free window during rule deletion.\n\nFix this by unlinking the rule from the RCU-visible lists and invoking\n`synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other\nrule removal helpers). This ensures that all existing RCU readers have\nexited the critical section before any underlying resources are destroyed."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Reachable only via local NETLINK_AUDIT (AUDIT_DEL_RULE) or filesystem events that autoremove AUDIT_EXE rules; concurrent UAF readers run in syscall/io_uring exit audit filtering on the local host, not from remote network input.\nAC:L - The attacker controls both sides of the race by deleting an AUDIT_EXE rule (auditctl or deleting/moving the audited executable) while driving concurrent syscall/io_uring activity to keep RCU readers in audit_filter()/audit_filter_rules().\nPR:L - Besides CAP_AUDIT_CONTROL netlink deletion, unprivileged local users can trigger audit_del_rule() via fsnotify autoremove when deleting/moving an admin-configured audited executable they can write, without init-namespace root.\nUI:N - Exploitation requires no victim interaction; the attacker schedules rule deletion and concurrent audited syscalls/io_uring exits to hit the UAF window.\nS:U - Impact is kernel heap memory corruption and local privilege escalation within the host kernel security domain, not a documented cross-VM or IOMMU boundary escape.\nC:H - Use-after-free of audit_fsnotify_mark while audit_exe_compare()/audit_mark_compare() dereference mark->ino/dev enables arbitrary kernel memory reads and info disclosure primitives.\nI:H - Freed fsnotify mark objects can be reallocated and corrupted to obtain arbitrary kernel writes, control-flow hijack, and local root code execution beyond audit rule deletion.\nA:H - Concurrent dereference of a freed audit_fsnotify_mark during audit filtering can immediately oops/panic the kernel; repeated triggering yields reliable denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/auditfilter.c"], "versions": [{"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "93616c567469510b7bba55b2674e0c4523fd7e64", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "3f82927b399d7a276c0c12b6ff4424b747a0c9a7", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "8ae135a8962be9d4e8a131eb18eb06cdf02a47ce", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "45bf3df5b32e5a49953e7ceabc55f7dd85380e46", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbf", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "cae0dfed5d307b240bff71c3cf206652d1b6f215", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "5b8f46864f06d6dbacb7dcea52bc084dfd122638", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "246df90b5f1a8a6e6abbd2f058b029558720adec", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/auditfilter.c"], "versions": [{"version": "4.3", "status": "affected"}, {"version": "0", "lessThan": "4.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/93616c567469510b7bba55b2674e0c4523fd7e64"}, {"url": "https://git.kernel.org/stable/c/3f82927b399d7a276c0c12b6ff4424b747a0c9a7"}, {"url": "https://git.kernel.org/stable/c/8ae135a8962be9d4e8a131eb18eb06cdf02a47ce"}, {"url": "https://git.kernel.org/stable/c/45bf3df5b32e5a49953e7ceabc55f7dd85380e46"}, {"url": "https://git.kernel.org/stable/c/78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbf"}, {"url": "https://git.kernel.org/stable/c/cae0dfed5d307b240bff71c3cf206652d1b6f215"}, {"url": "https://git.kernel.org/stable/c/5b8f46864f06d6dbacb7dcea52bc084dfd122638"}, {"url": "https://git.kernel.org/stable/c/246df90b5f1a8a6e6abbd2f058b029558720adec"}], "title": "audit: fix potential use-after-free in audit_del_rule()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74512", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:58:42.622737Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:05:51.743Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74512", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:58:42.622737Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:58:43.495Z"}}], "cna": {"title": "audit: fix potential use-after-free in audit_del_rule()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Reachable only via local NETLINK_AUDIT (AUDIT_DEL_RULE) or filesystem events that autoremove AUDIT_EXE rules; concurrent UAF readers run in syscall/io_uring exit audit filtering on the local host, not from remote network input.\nAC:L - The attacker controls both sides of the race by deleting an AUDIT_EXE rule (auditctl or deleting/moving the audited executable) while driving concurrent syscall/io_uring activity to keep RCU readers in audit_filter()/audit_filter_rules().\nPR:L - Besides CAP_AUDIT_CONTROL netlink deletion, unprivileged local users can trigger audit_del_rule() via fsnotify autoremove when deleting/moving an admin-configured audited executable they can write, without init-namespace root.\nUI:N - Exploitation requires no victim interaction; the attacker schedules rule deletion and concurrent audited syscalls/io_uring exits to hit the UAF window.\nS:U - Impact is kernel heap memory corruption and local privilege escalation within the host kernel security domain, not a documented cross-VM or IOMMU boundary escape.\nC:H - Use-after-free of audit_fsnotify_mark while audit_exe_compare()/audit_mark_compare() dereference mark->ino/dev enables arbitrary kernel memory reads and info disclosure primitives.\nI:H - Freed fsnotify mark objects can be reallocated and corrupted to obtain arbitrary kernel writes, control-flow hijack, and local root code execution beyond audit rule deletion.\nA:H - Concurrent dereference of a freed audit_fsnotify_mark during audit filtering can immediately oops/panic the kernel; repeated triggering yields reliable denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "93616c567469510b7bba55b2674e0c4523fd7e64", "versionType": "git"}, {"status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "3f82927b399d7a276c0c12b6ff4424b747a0c9a7", "versionType": "git"}, {"status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "8ae135a8962be9d4e8a131eb18eb06cdf02a47ce", "versionType": "git"}, {"status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "45bf3df5b32e5a49953e7ceabc55f7dd85380e46", "versionType": "git"}, {"status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbf", "versionType": "git"}, {"status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "cae0dfed5d307b240bff71c3cf206652d1b6f215", "versionType": "git"}, {"status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "5b8f46864f06d6dbacb7dcea52bc084dfd122638", "versionType": "git"}, {"status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "246df90b5f1a8a6e6abbd2f058b029558720adec", "versionType": "git"}], "programFiles": ["kernel/auditfilter.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.3"}, {"status": "unaffected", "version": "0", "lessThan": "4.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.151", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.103", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.8", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/auditfilter.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/93616c567469510b7bba55b2674e0c4523fd7e64"}, {"url": "https://git.kernel.org/stable/c/3f82927b399d7a276c0c12b6ff4424b747a0c9a7"}, {"url": "https://git.kernel.org/stable/c/8ae135a8962be9d4e8a131eb18eb06cdf02a47ce"}, {"url": "https://git.kernel.org/stable/c/45bf3df5b32e5a49953e7ceabc55f7dd85380e46"}, {"url": "https://git.kernel.org/stable/c/78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbf"}, {"url": "https://git.kernel.org/stable/c/cae0dfed5d307b240bff71c3cf206652d1b6f215"}, {"url": "https://git.kernel.org/stable/c/5b8f46864f06d6dbacb7dcea52bc084dfd122638"}, {"url": "https://git.kernel.org/stable/c/246df90b5f1a8a6e6abbd2f058b029558720adec"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix potential use-after-free in audit_del_rule()\n\n`audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()`\nbefore unlinking the rule from RCU-visible filter lists and waiting for a\ngrace period. Concurrent readers in `audit_filter()` and\n`audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify\nmark can be freed on an independent lifetime path. This creates a\nuse-after-free window during rule deletion.\n\nFix this by unlinking the rule from the RCU-visible lists and invoking\n`synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other\nrule removal helpers). This ensures that all existing RCU readers have\nexited the critical section before any underlying resources are destroyed."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.151", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.103", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.44", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.8", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:38:09.879Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74512", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:05:51.743Z", "dateReserved": "2026-08-15T05:44:03.909Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T12:27:33.736Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/auditfilter.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "93616c567469510b7bba55b2674e0c4523fd7e64", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "3f82927b399d7a276c0c12b6ff4424b747a0c9a7", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "8ae135a8962be9d4e8a131eb18eb06cdf02a47ce", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "45bf3df5b32e5a49953e7ceabc55f7dd85380e46", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbf", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "cae0dfed5d307b240bff71c3cf206652d1b6f215", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "5b8f46864f06d6dbacb7dcea52bc084dfd122638", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "246df90b5f1a8a6e6abbd2f058b029558720adec", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/auditfilter.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.3"}, {"lessThan": "4.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix potential use-after-free in audit_del_rule()\n\n`audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()`\nbefore unlinking the rule from RCU-visible filter lists and waiting for a\ngrace period. Concurrent readers in `audit_filter()` and\n`audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify\nmark can be freed on an independent lifetime path. This creates a\nuse-after-free window during rule deletion.\n\nFix this by unlinking the rule from the RCU-visible lists and invoking\n`synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other\nrule removal helpers). This ensures that all existing RCU readers have\nexited the critical section before any underlying resources are destroyed."}], "id": "CVE-2026-74512", "lastModified": "2026-10-16T20:17:33.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74512", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:58:42.622737Z", "version": "2.0.3"}}]}, "published": "2026-08-15T13:17:56.300", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/246df90b5f1a8a6e6abbd2f058b029558720adec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3f82927b399d7a276c0c12b6ff4424b747a0c9a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/45bf3df5b32e5a49953e7ceabc55f7dd85380e46"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b8f46864f06d6dbacb7dcea52bc084dfd122638"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8ae135a8962be9d4e8a131eb18eb06cdf02a47ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/93616c567469510b7bba55b2674e0c4523fd7e64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cae0dfed5d307b240bff71c3cf206652d1b6f215"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: audit: fix potential use-after-free in audit_del_rule()", "id": "2517054", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517054"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\naudit: fix potential use-after-free in audit_del_rule()\n`audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()`\nbefore unlinking the rule from RCU-visible filter lists and waiting for a\ngrace period. Concurrent readers in `audit_filter()` and\n`audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify\nmark can be freed on an independent lifetime path. This creates a\nuse-after-free window during rule deletion.\nFix this by unlinking the rule from the RCU-visible lists and invoking\n`synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other\nrule removal helpers). This ensures that all existing RCU readers have\nexited the critical section before any underlying resources are destroyed.", "A flaw was found in the Linux kernel. During the deletion of audit rules, the `audit_del_rule()` function prematurely frees a resource while other kernel functions can still access it. This creates a use-after-free vulnerability, which a local attacker could potentially exploit to cause system instability, information disclosure, or potentially escalate privileges."], "name": "CVE-2026-74512", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74512\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74512\nhttps://lore.kernel.org/linux-cve-announce/2026081543-CVE-2026-74512-3449@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,45bf3df5b32e5a49953e7ceabc55f7dd85380e46)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,cae0dfed5d307b240bff71c3cf206652d1b6f215)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,5b8f46864f06d6dbacb7dcea52bc084dfd122638)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,246df90b5f1a8a6e6abbd2f058b029558720adec)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.151,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.103,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T14:45:03.922109+00:00", "updated": "2026-08-21T20:30:07.398202+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-665", "CWE-825"]}