Description

In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in audit_del_rule() `audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()` before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in `audit_filter()` and `audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify mark can be freed on an independent lifetime path. This creates a use-after-free window during rule deletion. Fix this by unlinking the rule from the RCU-visible lists and invoking `synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other rule removal helpers). This ensures that all existing RCU readers have exited the critical section before any underlying resources are destroyed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:56.300Z",
  "pubdate": "2026-08-15T13:17:56.300Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel audit subsystem, specifically within the audit_del_rule() function. The vulnerability is classified as a use-after-free vulnerability affecting the Linux kernel audit filter rule management component. It can lead to memory corruption, potential kernel crashes, or local privilege escalation under specific race condition scenarios.\nThe affected systems include any Linux kernel deployments utilizing the audit subsystem's executable filtering capabilities via fsnotify marks. The risk implications involve system instability and potential local exploitation if an attacker can trigger concurrent rule deletion and rule evaluation.\nAttacker capabilities require local execution access to interact with the audit subsystem, typically through administrative interfaces or policy management tools that trigger rule deletion. Exploitation requires precise timing to race the asynchronous memory destruction of the fsnotify mark against concurrent RCU-protected filter evaluations.",
  "technicalDetails": "The root cause of the vulnerability resides in the improper ordering of resource destruction and RCU synchronization within audit_del_rule(). Specifically, audit_del_rule() previously destroyed e->rule.exe via audit_remove_mark_rule() prior to unlinking the rule from RCU-visible filter lists and waiting for an RCU grace period.\nThe vulnerable component is the audit subsystem of the Linux kernel, specifically functions audit_del_rule(), audit_filter(), audit_filter_rules(), and audit_remove_mark_rule().\nDuring rule deletion, concurrent readers executing audit_filter() or audit_filter_rules() can still dereference e->rule.exe. Because the fsnotify mark is freed on an independent lifetime path without respecting the RCU grace period, a critical race condition occurs. This creates a narrow use-after-free window where a reader thread accesses memory that has already been deallocated.\nThe attack flow proceeds as follows: First, an audit rule containing an exe component is active in the RCU-visible filter lists. Second, a thread initiates the deletion of this rule via audit_del_rule(). Third, instead of unlinking the rule and waiting for a grace period, the kernel immediately invokes audit_remove_mark_rule(), freeing the underlying fsnotify mark. Fourth, concurrently, another thread evaluates audit events through audit_filter() or audit_filter_rules(), dereferencing the now-dangling pointer to e->rule.exe. Fifth, this use-after-free access results in memory corruption, kernel panics, or potentially exploitable state changes depending on heap layout and timing.\nThe vulnerability requires local access and typically local administrative privileges to modify or delete audit rules. No network exposure is directly involved unless mediated by a userspace daemon with audit configuration capabilities. Post-exploitation impact ranges from local denial of service via kernel crashes to unpredictable kernel memory manipulation."
}