CVE-2026-89643 Overview
CVE-2026-89643 is a use-after-free vulnerability in the Linux kernel audit subsystem. The flaw resides in audit_del_rule(), which serves both netlink deletion templates and internal fsnotify autoremove paths. An unconditional audit_put_tree() call at the end of the function incorrectly drops a live tree reference during fsnotify autoremove events on mixed AUDIT_DIR plus AUDIT_EXE rules. Repeated autoremove events across rules that share the same tree can free the tree while another rule still holds a reference, causing subsequent dereferences of freed memory during rule comparison.
Critical Impact
The vulnerability can lead to kernel memory corruption through use-after-free, potentially enabling privilege escalation or denial of service on affected Linux systems.
Affected Products
- Linux kernel versions containing the pre-patch audit_del_rule() implementation
- Systems configured with audit rules combining AUDIT_DIR and AUDIT_EXE filters
- Distributions shipping the vulnerable audit subsystem across the eight referenced stable branches
Discovery Timeline
- 2026-09-11 - CVE-2026-89643 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89643
Vulnerability Analysis
The Linux kernel audit subsystem allows administrators to define rules that trigger notifications on filesystem and execution events. The function audit_del_rule() handles two distinct deletion paths: netlink-initiated deletions using a parsed template, and internal fsnotify autoremove events using the installed rule entry itself.
The template case owns a temporary tree reference that must be released. The autoremove case passes the live installed entry, which holds a persistent tree reference required by other rules. The pre-patch code unconditionally called audit_put_tree() at function exit, treating both cases as template deletions.
When audit rules mix AUDIT_DIR and AUDIT_EXE filters and share a common tree, repeated fsnotify autoremove events drop live references. Once the reference count reaches zero, the tree is freed while other rules still point to it. A later autoremove operation then dereferences the freed pathname during rule comparison, producing a use-after-free condition.
Root Cause
The root cause is incorrect reference counting semantics in audit_del_rule(). The function conflated ownership of the tree reference between two callers with different lifetime contracts. Only the netlink template caller owns a temporary reference that must be released by the callee.
Attack Vector
Exploitation requires triggering fsnotify autoremove events against audit rules that combine AUDIT_DIR and AUDIT_EXE filters sharing the same tree. An attacker with the ability to influence filesystem events monitored by such rules can accelerate the reference-count corruption and race a subsequent rule comparison against the freed pathname. See the kernel commits referenced below for the full patch series and technical context.
Detection Methods for CVE-2026-89643
Indicators of Compromise
- Kernel oops or panic messages referencing audit_del_rule, audit_put_tree, or audit_compare_rule in dmesg and /var/log/kern.log
- KASAN reports flagging use-after-free access within the audit subsystem tree structures
- Unexpected removal of audit rules combining AUDIT_DIR and AUDIT_EXE filters without administrator action
Detection Strategies
- Monitor kernel ring buffers for stack traces originating in kernel/audit_tree.c and kernel/auditfilter.c
- Correlate audit rule autoremove events with subsequent kernel faults on the same host
- Compare running kernel versions against the fixed commits published on git.kernel.org
Monitoring Recommendations
- Ingest kernel logs into a centralized SIEM and alert on audit-subsystem crash signatures
- Track audit rule inventories over time to identify unexpected rule deletions
- Enable kernel crash dump collection so post-mortem analysis can confirm use-after-free patterns
How to Mitigate CVE-2026-89643
Immediate Actions Required
- Inventory Linux systems running kernels that precede the fixed commits and prioritize patching
- Apply distribution-provided kernel updates that backport the audit fix as soon as available
- Review active audit rulesets for combinations of AUDIT_DIR and AUDIT_EXE filters that share trees
Patch Information
The fix moves the temporary-tree put out of audit_del_rule() and into audit_rule_change(), the caller that owns deletion templates. The put remains in the AUDIT_DEL_RULE cleanup path so both successful deletions and -ENOENT releases the parser-owned tree. The patch is available across multiple stable branches via the following commits: Kernel Git Commit 01b0ec8, Kernel Git Commit 583cf57, Kernel Git Commit 636a99b, Kernel Git Commit 695c85d, Kernel Git Commit 783f0f0, Kernel Git Commit 9cac21f, Kernel Git Commit b322cc7, and Kernel Git Commit cf37b61.
Workarounds
- Avoid deploying audit rules that combine AUDIT_DIR and AUDIT_EXE filters targeting the same tree until patching
- Restrict which users can modify audit rules via auditctl to reduce exposure surface
- Reboot into a patched kernel after installing vendor updates to ensure the fix is active
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
