CVE-2026-89600: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89600 Overview

CVE-2026-89600 is a use-after-free vulnerability in the Linux kernel's fanotify filesystem notification subsystem. The flaw lives in the fsnotify_pre_content() code path, where a file_range structure is built on the triggering task's stack. The heap-allocated permission event stores a pointer to that stack-resident range through fanotify_alloc_perm_event(), which the reader later dereferences in copy_range_info_to_user(). When a signal cancels the triggering task before the reader completes, the stack frame is torn down while the pointer remains live, producing a use-after-free. KASAN confirmed the issue during read operations in fanotify_read().

Critical Impact
A local user can trigger a kernel use-after-free that leaks stale stack memory to userspace and may enable local privilege escalation on affected Linux systems.

Affected Products

Linux kernel branches containing the fanotify pre-content event support prior to the fix commits
Distribution kernels that ship the vulnerable fsnotify_pre_content() and fanotify_alloc_perm_event() code paths
Systems using fanotify permission events with file range reporting enabled

Discovery Timeline

2026-09-11 - CVE-2026-89600 published to the National Vulnerability Database
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89600

Vulnerability Analysis

The vulnerability sits at the boundary between two lifetimes: the triggering task's stack frame and the heap-allocated permission event owned by the reader. fsnotify_pre_content() constructs a file_range on the triggering task's stack. fanotify_alloc_perm_event() then stashes a pointer to range.pos inside the permission event so copy_range_info_to_user() can later report the file offset to the userspace reader.

The reader can transition the event state to FAN_EVENT_REPORTED and then sleep while preparing the file descriptor for delivery. If a signal interrupts the triggering task during that window, fanotify_get_response() moves the state to FAN_EVENT_CANCELED and returns to the caller. The stack frame holding file_range unwinds, but the reader still holds the event and its pointer to the now-invalid stack memory. When the reader resumes and dereferences pevent->ppos, it reads freed stack data and copies it to userspace.

Root Cause

The root cause is a lifetime mismatch between the heap-allocated permission event and the stack-allocated file_range structure it references. Event data whose lifetime must span multiple task contexts was placed on a caller-owned stack, violating the invariant that reader-visible metadata must outlive the triggering task's stack frame.

Attack Vector

Exploitation requires local access and the ability to issue fanotify operations. An attacker races a signal against a reader consuming a pre-content permission event. The kernel then discloses stale stack contents to the attacker's userspace process through fanotify_read(). Because arbitrary stack data may be leaked, the primitive can be chained with other techniques to defeat KASLR or influence subsequent kernel behavior. The KASAN trace shows the read of freed memory in fanotify_read+0x293e/0x2970 reached from vfs_read and ksys_read through the do_syscall_64 entry path.

No public proof-of-concept exploit is listed for CVE-2026-89600, and the issue is not present on CISA's Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-89600

Indicators of Compromise

KASAN reports referencing use-after-free in fanotify_read with reads originating from vfs_read and ksys_read
Unexpected kernel oops or panic messages naming fanotify_read, copy_range_info_to_user, or fanotify_get_response
Userspace processes repeatedly opening fanotify groups with FAN_CLASS_PRE_CONTENT and issuing signals to sibling threads

Detection Strategies

Enable KASAN on test and staging kernels to surface the freed-memory read during fuzzing or regression runs
Audit workloads that legitimately use fanotify pre-content permission events and baseline their syscall patterns
Correlate SIGINT/SIGKILL delivery to threads holding open fanotify file descriptors with subsequent kernel warnings

Monitoring Recommendations

Ship kernel ring buffer messages and KASAN output to a centralized log store for triage
Alert on kernel panics or BUG: entries matching fanotify symbols
Track process-level use of fanotify_init and fanotify_mark to identify unexpected consumers of pre-content events

How to Mitigate CVE-2026-89600

Immediate Actions Required

Apply the upstream stable kernel updates that include the three referenced fix commits as soon as vendor packages are available
Inventory hosts running kernels with fanotify pre-content support and prioritize multi-tenant or shared systems for patching
Restrict CAP_SYS_ADMIN where feasible, since fanotify permission event groups require it

Patch Information

The fix stores the range position directly inside the permission event and uses FANOTIFY_NO_RANGE when range information is unavailable, ensuring the reported offset no longer depends on the triggering task's stack. The upstream commits are available at kernel.org commit 66aa9a9e, kernel.org commit b8f73b16, and kernel.org commit d7f1cf5b. Consume the fix through your distribution's stable kernel channel to preserve vendor support.

Workarounds

Disable or block userspace access to fanotify pre-content event classes until patched kernels are deployed
Use Linux capability restrictions or seccomp filters to prevent untrusted processes from calling fanotify_init with FAN_CLASS_PRE_CONTENT
Reduce local attack surface by limiting shell access on affected hosts and enforcing least privilege for service accounts

bash

# Verify running kernel version and fanotify capability exposure
uname -r
grep -R CONFIG_FANOTIFY /boot/config-$(uname -r)
getcap -r /usr/bin 2>/dev/null | grep -i sys_admin