CVE-2026-98986

The Linux kernel contains a vulnerability where fsnotify marks of a mount namespace are removed from an RCU softirq context instead of a process context. This occurs because mnt_ns_tree_remove() hands a reference to call_rcu(), causing fsnotify_mntns_delete() to trigger a BUG by calling a sleepin...

EUVD-2026-108780

In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mntnsrelease drops the last passive reference of a mount namespace and removes its fanotify marks via fsnotifymntnsdelete. That takes the mutex of every...

CVE-2026-98862

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in killrules killrules removes mixed AUDITDIR and AUDITEXE rules when an audit tree is pruned. It drops entry-rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been...

DEBIAN-CVE-2026-98862

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in killrules killrules removes mixed AUDITDIR and AUDITEXE rules when an audit tree is pruned. It drops entry-rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been...

EUVD-2026-103802

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in killrules killrules removes mixed AUDITDIR and AUDITEXE rules when an audit tree is pruned. It drops entry-rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Audit: Avoid dropping the live tree reference in the fsnotify autoremove operation. The auditdelrule function is used for both netlink deletion templates and internal fsnotify autoremove operations. In the former case, a parsed...

SUSE CVE-2026-97619

In the Linux kernel, the following vulnerability has been resolved: iouring/rw: end write accounting from -kicomplete Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the ioreqrwcomplete taskwork. However, only the fsnotify pa...

Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_53330)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202653330 advisory. kernel: fsnotify: Fix ordering of iput and watchedobjects decrement CVE-2024-53143 kernel: shmem: fix recovery on rename failures CVE-2025-71072 kernel...

DEBIAN-CVE-2026-97619

In the Linux kernel, the following vulnerability has been resolved: iouring/rw: end write accounting from -kicomplete Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the ioreqrwcomplete taskwork. However, only the fsnotify pa...

EUVD-2026-86750

In the Linux kernel, the following vulnerability has been resolved: iouring/rw: end write accounting from -kicomplete Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the ioreqrwcomplete taskwork. However, only the fsnotify pa...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: fsnotify: Do not generate ACCESS/MODIFY events for special files in child processes. inotify/fanotify: Do not allow users who have no read access to a file to subscribe to events like INACCESS/INMODIFY. However, users can stil...

SUSE CVE-2026-89595

In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent mark updates When a mark gets a new event bit, fanotify and inotify may avoid recalculating the object mask if the cached aggregate already contains that bit. This is racy with a...

SUSE CVE-2026-89643

In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove auditdelrule is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference;...

Linux Distros Unpatched Vulnerability : CVE-2026-89595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fsnotify: Fix stale object mask after concurrent mark updates When a mark gets a new event bit, fanotify and inotify may avoid recalculating the object mask if...

Linux Distros Unpatched Vulnerability : CVE-2026-89600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fanotify: fix use-after-free of file range info fsnotifyprecontent builds its filerange on the triggering task's stack. fanotifyallocpermevent saves a pointer t...

Linux Distros Unpatched Vulnerability : CVE-2026-89643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - audit: avoid dropping live tree ref on fsnotify rule autoremove auditdelrule is used for both netlink deletion templates and internal fsnotify autoremove. The...

CVE-2026-89595

A flaw was found in the Linux kernel's fsnotify subsystem, affecting fanotify and inotify. A race condition can occur during concurrent updates to event marks, where the object mask becomes stale. This can lead to a denial of service or information disclosure, as events such as file modifications...

CVE-2026-89643

A flaw was found in the Linux kernel's audit subsystem. When fsnotify rules are automatically removed, the system incorrectly manages memory references, leading to a situation where freed memory can be accessed again. This memory corruption vulnerability could allow a local attacker to cause a...

DEBIAN-CVE-2026-89643

In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove auditdelrule is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference;...

AZL-100316 CVE-2026-89643 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove auditdelrule is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference;...