In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and… (CVE-2026-98862)

The Linux kernel audit subsystem had a use-after-free vulnerability (CVE-2026-98862) in the kill_rules() function. kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when pruning an audit tree and drops entry->rule.exe before removing the rule from RCU-visible filter lists. When a rule installed with AUDIT_ADD_RULE is removed concurrently with another task evaluating it, fsnotify can free the executable mark before audit_mark_compare() reads it, causing a use-after-free. The fix unlinks rules from RCU-visible lists and retains them on tree->rules for cleanup, waiting for an RCU grace period before removing executable marks and scheduling entries for freeing, ensuring safe deferred freeing.

This vulnerability could lead to a use-after-free condition in the kernel audit subsystem, which may cause kernel crashes or undefined behavior. There is no indication of active exploitation in the wild. The impact is limited to kernel stability and potential denial of service rather than direct privilege escalation or data corruption based on the provided data.

A fix has been implemented to address this vulnerability by modifying the cleanup process in kill_rules() to wait for an RCU grace period before freeing executable marks. Users should apply the official Linux kernel patches that include this fix. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation. No additional mitigations are specified or required beyond applying the fix.