EUVD-2026-76512
GHSA-hfc9-63gq-6mcj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requiring precise signal-delivery timing warrants AC:H over vendor AC:L; PR:L reflects required fanotify API access; scope unchanged, all three impact dimensions high for kernel UAF.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
fanotify: fix use-after-free of file range info
fsnotify_pre_content() builds its file_range on the triggering task's stack. fanotify_alloc_perm_event() saves a pointer to range.pos in the heap-allocated permission event so copy_range_info_to_user() can report the offset later.
The event reader can set the event state to FAN_EVENT_REPORTED and then sleep while preparing the file descriptor. If a signal interrupts the triggering task at that point, fanotify_get_response() changes the state to FAN_EVENT_CANCELED and returns. This unwinds the file_range stack frame while the reader still owns the event. The reader then dereferences pevent->ppos and copies the stale stack value to userspace.
KASAN reported:
BUG: KASAN: use-after-free in fanotify_read+0x293e/0x2970 Read of size 8 at addr ffff88811434fc50 by task fanotify_inotif/95 Call Trace: fanotify_read+0x293e/0x2970 vfs_read+0x177/0xa20 ksys_read+0xf7/0x1c0 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Store the range position directly in the permission event and use FANOTIFY_NO_RANGE when range information is unavailable. The event remains alive until the reader finishes, so the reported offset no longer depends on the triggering task's stack.
AnalysisAI
Use-after-free in the Linux kernel fanotify subsystem (introduced in 6.14) copies stale kernel stack memory to userspace and may enable local privilege escalation on unpatched 6.18.x and 7.x kernels. When a signal interrupts the triggering task precisely after the event reader sets FAN_EVENT_REPORTED but before it finishes preparing the file descriptor, fanotify_get_response() unwinds the stack-allocated file_range frame while the reader retains a dangling pointer to range.pos; the subsequent copy_range_info_to_user() dereferences freed stack memory, confirmed by KASAN. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local process with sufficient privilege to invoke fanotify_init() with FAN_CLASS_PRE_CONTENT and successfully install a fanotify mark on a filesystem object - this requires CAP_SYS_ADMIN or equivalent LSM permission in default configurations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 7.8 (AV:L/AC:L) likely overstates exploitability: the race condition requires delivering a signal at a narrow timing window relative to an independent reader thread, which in practice warrants AC:H rather than AC:L, placing the realistic base score closer to 7.0. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to Linux kernel 6.18.50, 7.2.4, or 7.3-rc1, or to cherry-pick stable-tree commit 66aa9a9e6481bfa512ee5b6380eaaec455a954d2 (6.18.x), d7f1cf5be33ef0175a4e8ed8687aeb98fb00a851, or b8f73b163b646bc56d4dce9c697a578e333f4894 from https://git.kernel.org/stable/c/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit systems running kernels 6.18.x through 7.2.3 to identify exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today