CVE-2026-98862: Linux Vulnerability

Description

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been installed with AUDIT_ADD_RULE, which requires CAP_AUDIT_CONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches audit_mark_compare(), causing a use-after-free. KASAN reports: BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0 Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call_rcu() already provides the required deferred freeing without a synchronous wait.

Metrics

EPSS Probability

0.16%

4.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 34d99af52ad40bd498ba66970579a5bc1fb1a3bc, < 8d9c97fb262067933ff4452db19e692d26622352; >= 34d99af52ad40bd498ba66970579a5bc1fb1a3bc, < 11715656540360906235d724fde5349631425073; >= 34d99af52ad40bd498ba66970579a5bc1fb1a3bc, < 0afb9202c1fb88387d0577524bf9785664bdd802; >= 34d99af52ad40bd498ba66970579a5bc1fb1a3bc, < 9aee3caeff4dd4126d84f67607b95cec8719b867; >= 34d99af52ad40bd498ba66970579a5bc1fb1a3bc, < 304960900991157e6883bdf0b39782b690545ee8; >= 34d99af52ad40bd498ba66970579a5bc1fb1a3bc, < 88633025f20ba9c32ccdb3efc86eafdf98cb825c; >= 34d99af52ad40bd498ba66970579a5bc1fb1a3bc, < f2cc5462b78559c7628a9f8ac9a9592e7783183a; >= 34d99af52ad40bd498ba66970579a5bc1fb1a3bc, < aa650d87a498844060eecb1d336f4d46f4d1b0b3
Linux	Linux	4.3

References

Timeline

Published: Oct 18, 2026
Last Modified: Oct 30, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-98862?

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been installed with AUDIT_ADD_RULE, which requires CAP_AUDIT_CONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches audit_mark_compare(), causing a use-after-free. KASAN reports: BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0 Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call_rcu() already provides the required deferred freeing without a synchronous wait.

How severe is CVE-2026-98862?

Severity scoring for CVE-2026-98862 is pending analysis. The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.

How do I fix CVE-2026-98862?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →