CVE-2026-98862: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98862 Overview

CVE-2026-98862 is a use-after-free vulnerability in the Linux kernel audit subsystem. The flaw resides in kill_rules(), which removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. The function drops entry->rule.exe before removing the rule from the RCU-visible filter lists, creating a race window. A concurrent task evaluating the rule can access the executable mark after fsnotify has freed it. KASAN reports the condition as a slab-use-after-free in audit_mark_compare(). The upstream kernel maintainers have resolved the issue across multiple stable branches.

Critical Impact
A local task racing audit rule removal can trigger a kernel use-after-free in audit_mark_compare(), enabling kernel memory corruption and potential privilege escalation.

Affected Products

Linux kernel (upstream)
Linux stable branches patched in commits 304960900991, 88633025f20b, 9aee3caeff4d, aa650d87a498, and f2cc5462b785
Distributions shipping the audit subsystem with the affected kill_rules() logic

Discovery Timeline

2026-10-18 - CVE-2026-98862 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98862

Vulnerability Analysis

The Linux audit subsystem supports rule types that watch directories (AUDIT_DIR) and executable paths (AUDIT_EXE). When an audit tree is pruned, kill_rules() tears down rules matching that tree. The function releases the executable mark referenced through entry->rule.exe before unlinking the rule from the RCU-protected filter lists. Readers walking those lists under RCU can still reach the rule and call audit_mark_compare(), which dereferences the already-freed mark. The result is a slab use-after-free in kernel context, detected by KASAN. The condition is a classic ordering bug: freeing an object that remains reachable to concurrent readers [CWE-416].

Root Cause

The root cause is an incorrect teardown order combined with insufficient RCU synchronization. kill_rules() drops the executable mark through fsnotify before the rule is removed from the RCU-visible lists, and no grace period is observed between the mark release and reader visibility. A reader that obtained a pointer to the rule before the unlink can race the freeing path and dereference the freed exe mark inside audit_mark_compare().

Attack Vector

Exploitation requires the ability to install audit rules, which is gated by CAP_AUDIT_CONTROL. After an attacker-controlled or privileged process adds a rule with AUDIT_ADD_RULE, unlinking the watched directory triggers the pruning path. A second task evaluating the same rule can land in audit_mark_compare() after the mark is freed, producing memory corruption in the kernel slab allocator. The vulnerability is local and depends on winning the race between pruning and rule evaluation.

No public exploit code is available. See the upstream commits listed in the references for the authoritative fix details.

Detection Methods for CVE-2026-98862

Indicators of Compromise

KASAN splats reporting BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0 in dmesg or kernel logs.
Unexpected kernel oopses or panics referencing the audit filter lists or fsnotify mark structures.
Repeated audit rule add and remove operations correlated with directory unlink events on the same path.

Detection Strategies

Enable KASAN on test or canary kernels to surface the use-after-free on triggering workloads.
Monitor privileged use of CAP_AUDIT_CONTROL and track processes issuing AUDIT_ADD_RULE and AUDIT_DEL_RULE calls through audit metadata.
Correlate audit rule churn with filesystem unlink events against directories referenced by active audit trees.

Monitoring Recommendations

Centralize kernel ring buffer and journald output and alert on KASAN or oops signatures mentioning audit_mark_compare or kill_rules.
Track kernel versions across the fleet to confirm the fix is deployed on every host running the audit subsystem.
Baseline the set of processes with CAP_AUDIT_CONTROL and alert on new entrants.

How to Mitigate CVE-2026-98862

Immediate Actions Required

Upgrade to a Linux kernel release that includes the fix commits 304960900991, 88633025f20b, 9aee3caeff4d, aa650d87a498, or f2cc5462b785 on the matching stable branch.
Audit the list of accounts and workloads holding CAP_AUDIT_CONTROL and remove the capability where it is not required.
Prioritize patching on multi-tenant hosts, container nodes, and systems that expose shell access to lower-privileged administrators.

Patch Information

The fix unlinks published rules from the RCU-visible lists first and retains them on tree->rules for cleanup. If any rule carries an executable mark, the kernel waits for one RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call_rcu() already provides the required deferred freeing. See the authoritative commits: Kernel Git Commit 304960900991, Kernel Git Commit 88633025f20b, Kernel Git Commit 9aee3caeff4d, Kernel Git Commit aa650d87a498, and Kernel Git Commit f2cc5462b785.

Workarounds

Restrict CAP_AUDIT_CONTROL to a minimal set of trusted administrative accounts until the patched kernel is deployed.
Avoid runtime churn of audit rules that mix AUDIT_DIR and AUDIT_EXE filters on directories subject to unlink operations.
Where feasible, pin audit rule sets at boot and defer rule modifications to maintenance windows on patched hosts.

bash

# Verify the running kernel includes one of the fix commits
uname -r
zcat /proc/config.gz 2>/dev/null | grep CONFIG_AUDIT

# Enumerate processes with CAP_AUDIT_CONTROL
getpcaps $(pgrep -d, .) 2>/dev/null | grep -i audit_control