CVE-2026-89643

In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove auditdelrule is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference;...

CVE-2026-89643

A use-after-free vulnerability exists in the Linux kernel's audit subsystem . The function audit_del_rule() unconditionally calls audit_put_tree() at its end, assuming it always handles a temporary parser-owned tree reference. However, when invoked via fsnotify autoremove for mixed AUDIT_DIR + AU...

CVE-2026-89643 audit: avoid dropping live tree ref on fsnotify rule autoremove

In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove auditdelrule is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference;...