EUVD-2026-76555
GHSA-qh9h-fg7c-vgxw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires local CAP_AUDIT_CONTROL (PR:H) and a specific rule config plus race (AC:H); UAF primarily yields kernel crash (A:H) with limited/unproven C/I impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
audit: avoid dropping live tree ref on fsnotify rule autoremove
audit_del_rule() is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference; the latter passes the installed entry itself.
The unconditional audit_put_tree() at the end of audit_del_rule() assumes the template case. For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify autoremove event therefore drops the installed rule's live tree reference. Repeating this across rules sharing the same tree can free the tree while another rule still references it, and a later autoremove dereferences the freed pathname while comparing rules.
Move the temporary-tree put to audit_rule_change(), the caller that owns deletion templates. Keep it in the AUDIT_DEL_RULE cleanup so both successful deletion and -ENOENT still release the parser-owned tree.
[PM: dropped unnecessary comment for line length reasons]
AnalysisAI
Use-after-free in the Linux kernel audit subsystem lets a local privileged operator free an audit tree while another rule still references it, later dereferencing a freed pathname. The flaw is in audit_del_rule(), which unconditionally calls audit_put_tree() as if handling a netlink deletion template; when invoked via fsnotify autoremove for mixed AUDIT_DIR plus AUDIT_EXE rules it instead drops the installed rule's live tree reference. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access with CAP_AUDIT_CONTROL to install and delete audit rules, plus an audit ruleset that combines AUDIT_DIR (directory-tree watch) and AUDIT_EXE rules sharing the same tree object. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) is inconsistent with the described mechanism and should be treated as inflated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or your distribution's backported equivalent carrying the listed fix commits). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running affected kernel versions (6.12.x before 109, 6.18.x before 50, 7.2.x before 4, or earlier branches) and catalog which systems have active audit functionality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today