{"id":"CVE-2026-74512","revision":"5285c6fd405148209a12d66d09f42b54","records":[{"revision":"5285c6fd405148209a12d66d09f42b54","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74512","aliases":[],"title":"audit: fix potential use-after-free in audit_del_rule()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix potential use-after-free in audit_del_rule()\n\n`audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()`\nbefore unlinking the rule from RCU-visible filter lists and waiting for a\ngrace period. Concurrent readers in `audit_filter()` and\n`audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify\nmark can be freed on an independent lifetime path. This creates a\nuse-after-free window during rule deletion.\n\nFix this by unlinking the rule from the RCU-visible lists and invoking\n`synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other\nrule removal helpers). This ensures that all existing RCU readers have\nexited the critical section before any underlying resources are destroyed.","state":0,"publishedAt":"2026-08-15T12:27:33.736+00:00","modifiedAt":"2026-10-16T19:05:51.743+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/auditfilter.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"93616c567469510b7bba55b2674e0c4523fd7e64\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"3f82927b399d7a276c0c12b6ff4424b747a0c9a7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"8ae135a8962be9d4e8a131eb18eb06cdf02a47ce\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"45bf3df5b32e5a49953e7ceabc55f7dd85380e46\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"cae0dfed5d307b240bff71c3cf206652d1b6f215\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"5b8f46864f06d6dbacb7dcea52bc084dfd122638\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"246df90b5f1a8a6e6abbd2f058b029558720adec\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/auditfilter.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.151\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.103\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.44\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.8\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/93616c567469510b7bba55b2674e0c4523fd7e64","https://git.kernel.org/stable/c/3f82927b399d7a276c0c12b6ff4424b747a0c9a7","https://git.kernel.org/stable/c/8ae135a8962be9d4e8a131eb18eb06cdf02a47ce","https://git.kernel.org/stable/c/45bf3df5b32e5a49953e7ceabc55f7dd85380e46","https://git.kernel.org/stable/c/78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbf","https://git.kernel.org/stable/c/cae0dfed5d307b240bff71c3cf206652d1b6f215","https://git.kernel.org/stable/c/5b8f46864f06d6dbacb7dcea52bc084dfd122638","https://git.kernel.org/stable/c/246df90b5f1a8a6e6abbd2f058b029558720adec"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74512","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74512","identifiers":["CVE-2026-74512"]},"retained":false,"historicalAffected":[]}],"coverage":[]}