CVE-2026-89600

In the Linux kernel, the following vulnerability has been resolved:

fanotify: fix use-after-free of file range info

fsnotify pre content() builds its file range on the triggering task's stack. fanotify alloc perm event() saves a pointer to range.pos in the heap-allocated permission event so copy range info to user() can report the offset later.

The event reader can set the event state to FAN EVENT REPORTED and then sleep while preparing the file descriptor. If a signal interrupts the triggering task at that point, fanotify get response() changes the state to FAN EVENT CANCELED and returns. This unwinds the file range stack frame while the reader still owns the event. The reader then dereferences pevent->ppos and copies the stale stack value to userspace.

KASAN reported:

BUG: KASAN: use-after-free in fanotify read+0x293e/0x2970 Read of size 8 at addr ffff88811434fc50 by task fanotify inotif/95 Call Trace: fanotify read+0x293e/0x2970 vfs read+0x177/0xa20 ksys read+0xf7/0x1c0 do syscall 64+0xf9/0x540 entry SYSCALL 64 after hwframe+0x77/0x7f

Store the range position directly in the permission event and use FANOTIFY NO RANGE when range information is unavailable. The event remains alive until the reader finishes, so the reported offset no longer depends on the triggering task's stack.