The Linux kernel fanotify subsystem had a use-after-free vulnerability (CVE-2026-89600) caused by fsnotify_pre_content() building file_range data on the triggering task's stack, while fanotify_alloc_perm_event() saved a pointer to this stack data in a heap-allocated permission event. If the event reader set the event state to FAN_EVENT_REPORTED and then slept, and the triggering task was interrupted by a signal, the stack frame containing the file_range was unwound but the reader still accessed the stale pointer, leading to use-after-free. The fix stores the range position directly in the permission event and uses FANOTIFY_NO_RANGE when range info is unavailable, ensuring the event remains valid until the reader finishes.

The vulnerability could allow a user-space process reading fanotify events to receive stale or invalid file range information due to use-after-free, potentially leading to incorrect data being processed or minor memory safety issues. There is no indication of privilege escalation or remote code execution from the provided data.

A fix has been implemented in the Linux kernel to address this vulnerability by changing how file range information is stored and accessed in fanotify permission events. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation.