CVE-2026-68096: Linux Kernel Race Condition Vulnerability

CVE-2026-68096 Overview

CVE-2026-68096 is a recursive locking deadlock in the Linux kernel's audit subsystem, specifically in the audit_dupe_exe() function. The flaw occurs when the VFS layer holds the I_MUTEX_PARENT lock during operations like do_renameat2(), which then triggers an fsnotify_move event. If a matching executable audit rule exists, the audit subsystem calls audit_alloc_mark(), which invokes kern_path_parent() and attempts to acquire the same directory lock already held by the task. The result is a kernel-side deadlock that can hang the calling process and impact system availability.

Critical Impact
A local unprivileged process can trigger a kernel deadlock by moving files that match an active executable audit rule, resulting in denial of service.

Affected Products

Linux kernel versions containing the vulnerable audit_dupe_exe() code path prior to the fix commits
Distributions shipping affected kernels (for example, kernel 6.12.0 builds referenced in the deadlock report)
Systems using audit rules with executable (-F exe=) filters combined with path watches

Discovery Timeline

2026-08-10 - CVE-2026-68096 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68096

Vulnerability Analysis

The vulnerability is a race-free but locking-unsafe code path in the Linux audit subsystem, classified as a deadlock condition [CWE-833]. The attack vector is local, and the primary impact is on availability. A local user with the ability to rename files that match an active audit rule can consistently trigger the deadlock.

The reproducer is straightforward. An administrator installs an audit rule matching an executable path, and a subsequent mv operation against that file triggers fsnotify_move, which drives the audit code into audit_dupe_exe() while the VFS parent-directory mutex is held. The kernel's lockdep validator flags the condition as possible recursive locking detected, and the offending task blocks indefinitely.

Root Cause

The root cause lies in audit_alloc_mark() calling kern_path_parent() to resolve the watched path while the caller is already holding I_MUTEX_PARENT from the enclosing rename operation. kern_path_parent() then attempts to acquire the same i_mutex_dir_key mutex, producing a recursive lock acquisition on the same object.

The call chain runs from do_renameat2() → vfs_rename() → fsnotify_move() → audit_watch_handle_event() → audit_update_watch() → audit_dupe_rule() → audit_dupe_exe() → audit_alloc_mark() → __kern_path_locked(), where the second acquisition of the parent directory mutex blocks.

Attack Vector

Exploitation requires a matching audit rule to be present on the system. An attacker with local shell access executes a rename of a file covered by such a rule. Because the fsnotify hook synchronously invokes audit rule duplication under the already-held VFS lock, the kernel thread becomes wedged. Repeated triggers can exhaust audit worker capacity and degrade system availability. The vulnerability does not provide code execution or information disclosure.

The upstream fix introduces a struct audit_watch_ctx to pass the fsnotify event context down to audit_alloc_mark(), allowing the audit code to reuse the already-resolved directory inode and bypass the redundant kern_path_parent() call. Refer to the Linux kernel commit 81905b5acbe7 and related stable-tree commits for the complete patch series.

Detection Methods for CVE-2026-68096

Indicators of Compromise

Kernel log entries containing WARNING: possible recursive locking detected with a call stack referencing audit_dupe_exe, audit_alloc_mark, and __kern_path_locked.
Processes stuck in uninterruptible sleep (D state) with stack traces pointing to audit_watch_handle_event or fsnotify_move.
Audit rule sets containing entries combining -F exe= filters with path watches on the same file.

Detection Strategies

Monitor dmesg and /var/log/messages for lockdep splats naming audit_dupe_exe or audit_dupe_rule in the stack trace.
Alert on mv, rename, or renameat syscalls that fail to complete or leave the invoking shell hung when audit rules are active.
Inventory audit rule configurations across managed Linux hosts to identify rules that combine executable filters with path watches.

Monitoring Recommendations

Ingest kernel log data into a centralized SIEM and build detections for lockdep warnings referencing the audit subsystem.
Track kernel versions across the fleet and flag hosts running builds prior to the fix commits listed in the kernel.org stable tree.
Correlate hung-task warnings (hung_task_timeout_secs) with audit subsystem activity to surface exploitation attempts.

How to Mitigate CVE-2026-68096

Immediate Actions Required

Apply the stable-kernel updates that include the audit_watch_ctx fix to audit_dupe_exe() as soon as your distribution publishes them.
Audit existing rule sets and remove or split rules that combine -F exe= with path watches against the same object until patching is complete.
Restrict access to accounts that can execute rename operations on audited paths where feasible.

Patch Information

The fix is distributed across multiple stable-tree commits, including 36eb77f14b4e, 3b601938314c, 40879c39d674, 7d1f66c69898, and 81905b5acbe7. Update to a distribution kernel that incorporates these commits and reboot to load the patched image.

Workarounds

Temporarily remove audit rules that pair executable filters with path watches by running auditctl -D and reloading a rule set that avoids the vulnerable pattern.
Reduce the blast radius by isolating audited executables in dedicated directories that are not subject to routine rename operations.
Enable hung_task_panic in test environments to detect the condition earlier during validation of audit configurations.

bash

# Remove all audit rules, then reload a rule set without the vulnerable pattern
auditctl -D
# Example: watch the file without combining exe= and path= filters on the same object
auditctl -w /tmp/file -p rwxa -k file_watch