« Volver al listado

CVE-2026-89643

Estado: RecibidaCrítica (9.8)—

In the Linux kernel, the following vulnerability has been resolved:

audit: avoid dropping live tree ref on fsnotify rule autoremove

audit_del_rule() is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree reference; the latter passes the installed entry itself.

The unconditional audit_put_tree() at the end of audit_del_rule() assumes the template case. For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify autoremove event therefore drops the installed rule's live tree reference. Repeating this across rules sharing the same tree can free the tree while another rule still references it, and a later autoremove dereferences the freed pathname while comparing rules.

Leer descripción completaMostrar menos

Move the temporary-tree put to audit_rule_change(), the caller that owns deletion templates. Keep it in the AUDIT_DEL_RULE cleanup so both successful deletion and -ENOENT still release the parser-owned tree.

[PM: dropped unnecessary comment for line length reasons]

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N sugiere T1190 (red sin privilegios), pero la vulnerabilidad es un use-after-free en kernel que potencialmente permite escalada (T1068) o DoS (T1499.004) tras dereferenciar memoria liberada.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability ScanningThreat Intelligence Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89643",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
              "lessThan": "9cac21f8eb82675ed19fb955b8bbb9dd14cc3d58",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
              "lessThan": "b322cc7adcd2e6ec1594d187533a126506ab545c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
              "lessThan": "695c85dc345a4e0292739f004c261bedef3f27e6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
              "lessThan": "01b0ec8c397be65ff710777c97017ca1de56ef8e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
              "lessThan": "cf37b61b5420fd4600fe78cf8c24da6e4d9bfe28",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
              "lessThan": "636a99bab36ba27515363d325866c0273ac83b3e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
              "lessThan": "583cf579b32d99e3fe4e9c8ecc4d852e3708fbec",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
              "lessThan": "783f0f0974c156aca630f4ffff248671082a098d",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/auditfilter.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/auditfilter.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:50.090",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/01b0ec8c397be65ff710777c97017ca1de56ef8e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/583cf579b32d99e3fe4e9c8ecc4d852e3708fbec",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/636a99bab36ba27515363d325866c0273ac83b3e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/695c85dc345a4e0292739f004c261bedef3f27e6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/783f0f0974c156aca630f4ffff248671082a098d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9cac21f8eb82675ed19fb955b8bbb9dd14cc3d58",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b322cc7adcd2e6ec1594d187533a126506ab545c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cf37b61b5420fd4600fe78cf8c24da6e4d9bfe28",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: avoid dropping live tree ref on fsnotify rule autoremove\n\naudit_del_rule() is used for both netlink deletion templates and internal\nfsnotify autoremove.  The former passes a parsed template which owns a\ntemporary tree reference; the latter passes the installed entry itself.\n\nThe unconditional audit_put_tree() at the end of audit_del_rule() assumes\nthe template case.  For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify\nautoremove event therefore drops the installed rule's live tree reference.\nRepeating this across rules sharing the same tree can free the tree while\nanother rule still references it, and a later autoremove dereferences the\nfreed pathname while comparing rules.\n\nMove the temporary-tree put to audit_rule_change(), the caller that owns\ndeletion templates.  Keep it in the AUDIT_DEL_RULE cleanup so both\nsuccessful deletion and -ENOENT still release the parser-owned tree.\n\n[PM: dropped unnecessary comment for line length reasons]"
    }
  ],
  "lastModified": "2026-09-14T13:19:17.080",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}