{"id":"CVE-2026-89643","revision":"652ebb85e5384659a353eece44c28c5c","records":[{"revision":"652ebb85e5384659a353eece44c28c5c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89643","aliases":[],"title":"audit: avoid dropping live tree ref on fsnotify rule autoremove","description":"In the Linux kernel, the following vulnerability has been resolved:\n\naudit: avoid dropping live tree ref on fsnotify rule autoremove\n\naudit_del_rule() is used for both netlink deletion templates and internal\nfsnotify autoremove.  The former passes a parsed template which owns a\ntemporary tree reference; the latter passes the installed entry itself.\n\nThe unconditional audit_put_tree() at the end of audit_del_rule() assumes\nthe template case.  For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify\nautoremove event therefore drops the installed rule's live tree reference.\nRepeating this across rules sharing the same tree can free the tree while\nanother rule still references it, and a later autoremove dereferences the\nfreed pathname while comparing rules.\n\nMove the temporary-tree put to audit_rule_change(), the caller that owns\ndeletion templates.  Keep it in the AUDIT_DEL_RULE cleanup so both\nsuccessful deletion and -ENOENT still release the parser-owned tree.\n\n[PM: dropped unnecessary comment for line length reasons]","state":0,"publishedAt":"2026-09-11T19:45:35.523+00:00","modifiedAt":"2026-10-19T08:50:15.077+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/auditfilter.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"9cac21f8eb82675ed19fb955b8bbb9dd14cc3d58\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"b322cc7adcd2e6ec1594d187533a126506ab545c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"695c85dc345a4e0292739f004c261bedef3f27e6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"01b0ec8c397be65ff710777c97017ca1de56ef8e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"cf37b61b5420fd4600fe78cf8c24da6e4d9bfe28\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"636a99bab36ba27515363d325866c0273ac83b3e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"583cf579b32d99e3fe4e9c8ecc4d852e3708fbec\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"34d99af52ad40bd498ba66970579a5bc1fb1a3bc\",\n                            \"lessThan\": \"783f0f0974c156aca630f4ffff248671082a098d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/auditfilter.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.109\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/9cac21f8eb82675ed19fb955b8bbb9dd14cc3d58","https://git.kernel.org/stable/c/b322cc7adcd2e6ec1594d187533a126506ab545c","https://git.kernel.org/stable/c/695c85dc345a4e0292739f004c261bedef3f27e6","https://git.kernel.org/stable/c/01b0ec8c397be65ff710777c97017ca1de56ef8e","https://git.kernel.org/stable/c/cf37b61b5420fd4600fe78cf8c24da6e4d9bfe28","https://git.kernel.org/stable/c/636a99bab36ba27515363d325866c0273ac83b3e","https://git.kernel.org/stable/c/583cf579b32d99e3fe4e9c8ecc4d852e3708fbec","https://git.kernel.org/stable/c/783f0f0974c156aca630f4ffff248671082a098d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89643","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89643","identifiers":["CVE-2026-89643"]},"retained":false,"historicalAffected":[]}],"coverage":[]}