CVE-2026-89643

An unconditional audit_put_tree() at the end of audit_del_rule() in the Linux kernel's audit subsystem drops a live tree reference when the function is invoked via fsnotify autoremove rather than via a user-supplied netlink deletion template. The flaw is triggered when audit rules that combine a directory watch (AUDIT_DIR) with an executable filter (AUDIT_EXE) are automatically removed after a watched path is deleted or moved; repeating this across rules sharing the same tree can free the tree while another rule still references it, and a later autoremove dereferences the freed pathname, a kernel use-after-free. Successful exploitation could cause kernel memory corruption — most plausibly a crash or denial of service, with theoretical code-execution impact — although reaching the code path generally requires the ability to install audit rules (typically root/CAP_AUDIT_CONTROL), which tempers the practical severity of the assigned 9.8 network-vector CVSS. Affected systems are those running a kernel carrying the buggy audit_del_rule() path and actually using mixed dir-watch plus exe-filter audit rules, a pattern typical of security-hardened or compliance-driven Linux servers. No public proof of concept is known, the issue is not in CISA's KEV catalog, and no exploitation has been reported.

What to do: Patch to a kernel release containing the fix once your distribution ships it; the correction moves the temporary audit_put_tree() from audit_del_rule() into audit_rule_change(), the netlink deletion-template caller that actually owns the temporary tree reference. In the interim, check 'auditctl -l' for rules combining dir/-w watches with exe= filters and consider restructuring them so fsnotify autoremove cannot drop the live tree reference. Monitor hardened and compliance servers using audit tree watches for audit-related oopses or unexplained crashes.