CVE-2026-98862

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98862", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.376Z", "datePublished": "2026-10-18T15:51:23.224Z", "dateUpdated": "2026-10-30T12:40:19.578Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:19.578Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix exe mark UAF in kill_rules()\n\nkill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit\ntree is pruned. It drops entry->rule.exe before removing the rule from\nthe RCU-visible filter lists.\n\nAfter a rule has been installed with AUDIT_ADD_RULE, which requires\nCAP_AUDIT_CONTROL, removing the watched directory can race with another\ntask that is still evaluating the rule. In that case, fsnotify can free\nthe executable mark before the reader reaches audit_mark_compare(),\ncausing a use-after-free.\n\nKASAN reports:\n\n BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0\n\nUnlink the published rules from the RCU-visible lists and retain them\non tree->rules for cleanup. If any rule has an executable mark, wait for\na single RCU grace period before removing the marks and scheduling the\nentries for freeing. Otherwise, call_rcu() already provides the required\ndeferred freeing without a synchronous wait."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/audit_tree.c"], "versions": [{"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "8d9c97fb262067933ff4452db19e692d26622352", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "11715656540360906235d724fde5349631425073", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "0afb9202c1fb88387d0577524bf9785664bdd802", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "9aee3caeff4dd4126d84f67607b95cec8719b867", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "304960900991157e6883bdf0b39782b690545ee8", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "88633025f20ba9c32ccdb3efc86eafdf98cb825c", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "f2cc5462b78559c7628a9f8ac9a9592e7783183a", "status": "affected", "versionType": "git"}, {"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "lessThan": "aa650d87a498844060eecb1d336f4d46f4d1b0b3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/audit_tree.c"], "versions": [{"version": "4.3", "status": "affected"}, {"version": "0", "lessThan": "4.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8d9c97fb262067933ff4452db19e692d26622352"}, {"url": "https://git.kernel.org/stable/c/11715656540360906235d724fde5349631425073"}, {"url": "https://git.kernel.org/stable/c/0afb9202c1fb88387d0577524bf9785664bdd802"}, {"url": "https://git.kernel.org/stable/c/9aee3caeff4dd4126d84f67607b95cec8719b867"}, {"url": "https://git.kernel.org/stable/c/304960900991157e6883bdf0b39782b690545ee8"}, {"url": "https://git.kernel.org/stable/c/88633025f20ba9c32ccdb3efc86eafdf98cb825c"}, {"url": "https://git.kernel.org/stable/c/f2cc5462b78559c7628a9f8ac9a9592e7783183a"}, {"url": "https://git.kernel.org/stable/c/aa650d87a498844060eecb1d336f4d46f4d1b0b3"}], "title": "audit: fix exe mark UAF in kill_rules()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/audit_tree.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8d9c97fb262067933ff4452db19e692d26622352", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "11715656540360906235d724fde5349631425073", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "0afb9202c1fb88387d0577524bf9785664bdd802", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "9aee3caeff4dd4126d84f67607b95cec8719b867", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "304960900991157e6883bdf0b39782b690545ee8", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "88633025f20ba9c32ccdb3efc86eafdf98cb825c", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "f2cc5462b78559c7628a9f8ac9a9592e7783183a", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}, {"lessThan": "aa650d87a498844060eecb1d336f4d46f4d1b0b3", "status": "affected", "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/audit_tree.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.3"}, {"lessThan": "4.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix exe mark UAF in kill_rules()\n\nkill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit\ntree is pruned. It drops entry->rule.exe before removing the rule from\nthe RCU-visible filter lists.\n\nAfter a rule has been installed with AUDIT_ADD_RULE, which requires\nCAP_AUDIT_CONTROL, removing the watched directory can race with another\ntask that is still evaluating the rule. In that case, fsnotify can free\nthe executable mark before the reader reaches audit_mark_compare(),\ncausing a use-after-free.\n\nKASAN reports:\n\n BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0\n\nUnlink the published rules from the RCU-visible lists and retain them\non tree->rules for cleanup. If any rule has an executable mark, wait for\na single RCU grace period before removing the marks and scheduling the\nentries for freeing. Otherwise, call_rcu() already provides the required\ndeferred freeing without a synchronous wait."}], "id": "CVE-2026-98862", "lastModified": "2026-10-30T13:21:31.480", "metrics": {}, "published": "2026-10-18T16:17:40.677", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0afb9202c1fb88387d0577524bf9785664bdd802"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/11715656540360906235d724fde5349631425073"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/304960900991157e6883bdf0b39782b690545ee8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/88633025f20ba9c32ccdb3efc86eafdf98cb825c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8d9c97fb262067933ff4452db19e692d26622352"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9aee3caeff4dd4126d84f67607b95cec8719b867"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aa650d87a498844060eecb1d336f4d46f4d1b0b3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f2cc5462b78559c7628a9f8ac9a9592e7783183a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: audit: fix exe mark UAF in kill_rules()", "id": "2555236", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555236"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\naudit: fix exe mark UAF in kill_rules()\nkill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit\ntree is pruned. It drops entry->rule.exe before removing the rule from\nthe RCU-visible filter lists.\nAfter a rule has been installed with AUDIT_ADD_RULE, which requires\nCAP_AUDIT_CONTROL, removing the watched directory can race with another\ntask that is still evaluating the rule. In that case, fsnotify can free\nthe executable mark before the reader reaches audit_mark_compare(),\ncausing a use-after-free.\nKASAN reports:\nBUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0\nUnlink the published rules from the RCU-visible lists and retain them\non tree->rules for cleanup. If any rule has an executable mark, wait for\na single RCU grace period before removing the marks and scheduling the\nentries for freeing. Otherwise, call_rcu() already provides the required\ndeferred freeing without a synchronous wait.", "A flaw was found in the Linux kernel's audit subsystem. A race condition can occur when an audit directory tree is removed while another process evaluates executable audit rules, causing the kernel to access memory after it has been released (a use-after-free condition). A local user with audit control privileges could exploit this flaw to cause memory corruption, leading to a system crash and Denial of Service (DoS) or potentially escalate privileges."], "name": "CVE-2026-98862", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98862\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98862\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98862.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,304960900991157e6883bdf0b39782b690545ee8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,88633025f20ba9c32ccdb3efc86eafdf98cb825c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,f2cc5462b78559c7628a9f8ac9a9592e7783183a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34d99af52ad40bd498ba66970579a5bc1fb1a3bc,aa650d87a498844060eecb1d336f4d46f4d1b0b3)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T21:30:14.253048+00:00", "updated": "2026-10-24T15:45:07.127992+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}