CVE-2026-68096

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A recursive locking deadlock occurs in the audit subsystem when duplicating executable-related rules. When a file is moved, the VFS layer locks the parent directory, which triggers an fsnotify move event. If an executable audit rule matches the file, the subsystem calls audit dupe exe() to update the rule. Subsequently, audit alloc mark() calls kern path parent() to resolve the path, which attempts to acquire the same parent directory lock already held by the task, resulting in a deadlock. This issue involves the audit dupe exe() and audit alloc mark() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.