Description

In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove audit_del_rule() is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference; the latter passes the installed entry itself. The unconditional audit_put_tree() at the end of audit_del_rule() assumes the template case. For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify autoremove event therefore drops the installed rule's live tree reference. Repeating this across rules sharing the same tree can free the tree while another rule still references it, and a later autoremove dereferences the freed pathname while comparing rules. Move the temporary-tree put to audit_rule_change(), the caller that owns deletion templates. Keep it in the AUDIT_DEL_RULE cleanup so both successful deletion and -ENOENT still release the parser-owned tree. [PM: dropped unnecessary comment for line length reasons]

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:50.090Z",
  "pubdate": "2026-09-11T20:19:50.090Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel's audit subsystem related to fsnotify rule handling.\nThe vulnerability stems from improper reference counting management during the removal of audit rules involving AUDIT_DIR and AUDIT_EXE flags.\nWhen an fsnotify autoremove event occurs, the kernel incorrectly decrements the reference count of an active audit tree, leading to premature memory deallocation of the tree structure.\nThis creates a race condition where subsequent autoremove operations may attempt to access or dereference memory that has already been freed, resulting in a use-after-free scenario.\nThe issue affects systems where auditing is enabled and specific audit rules monitoring directories are active. An attacker capable of triggering rule removals or manipulating filesystem watches could potentially exploit this condition.\nSuccessful exploitation may lead to kernel memory corruption, system instability, or potential local privilege escalation (LPE) depending on the state of the heap at the time of access.\nNo specific network exposure is required as the attack vector is local, requiring the ability to interact with the audit interface or trigger fsnotify events.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper ownership handling of tree references within audit_del_rule(). The audit_del_rule() function is dual-purpose: it processes netlink-based deletion requests and internal fsnotify-triggered autoremoves.\nIn the netlink case, a parsed template object holds a temporary reference to an audit tree, which must be released upon completion of the deletion logic. However, the existing implementation included an unconditional call to audit_put_tree() at the end of audit_del_rule(), regardless of whether the rule being processed was an ephemeral template or a live, installed rule.\nFor rules combining AUDIT_DIR and AUDIT_EXE, an fsnotify autoremove event initiates the removal of an installed rule. Because the current code path executes audit_put_tree() unconditionally, the live reference count of the shared tree is prematurely decremented. If multiple rules share the same audit tree, the first autoremove event may trigger a kfree() call on the tree structure while other rules still maintain internal pointers to it.\nWhen a subsequent rule removal attempt occurs, the audit subsystem attempts to dereference the pathname associated with the now-freed tree structure. This leads to a use-after-free condition. The attacker can trigger this state by populating the audit system with rules that share common watch trees and subsequently triggering conditions that cause the fsnotify subsystem to automatically remove these rules (e.g., deleting watched directories or files).\nExploitation requires local access to the system. The attacker must possess sufficient privileges to configure audit rules (e.g., CAP_AUDIT_CONTROL) or trigger filesystem events that force fsnotify autoremoves. By strategically placing rules, an attacker can induce the freeing of a target tree and then manipulate the kernel heap to place malicious data where the tree structure previously resided. When the kernel later accesses the freed pointer during subsequent rule validation or comparison, it may follow an attacker-controlled pointer, potentially leading to arbitrary code execution within the kernel context or a system panic.\nThe fix involves refactoring the codebase to move the audit_put_tree() call specifically to audit_rule_change(), ensuring that only the caller owning the deletion template is responsible for the reference cleanup, thereby preventing the premature destruction of live audit trees during fsnotify autoremove cycles."
}