CVE-2026-98862

In the Linux kernel, the following vulnerability has been resolved:

audit: fix exe mark UAF in kill rules()

kill rules() removes mixed AUDIT DIR and AUDIT EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists.

After a rule has been installed with AUDIT ADD RULE, which requires CAP AUDIT CONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches audit mark compare(), causing a use-after-free.

KASAN reports:

BUG: KASAN: slab-use-after-free in audit mark compare+0x8d/0xa0

Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call rcu() already provides the required deferred freeing without a synchronous wait.