CVE-2026-89643: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-89643 is a use-after-free / expired pointer dereference vulnerability in the Linux kernel's audit subsystem, specifically in the audit_del_rule() function. The flaw was introduced at commit 34d99af52ad40bd498ba66970579a5bc1fb1a3bc (present since Linux 4.3) and affects kernel versions up to but not including 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. It was published on September 11, 2026, with patches available the same day. The estimated CVSS severity is Medium, with an EPSS score of 0.0 at time of publication (Red Hat CVE, EUVD).

The root cause is an expired pointer dereference (CWE-825), with a secondary NULL pointer dereference risk (CWE-476), in the Linux kernel audit subsystem. audit_del_rule() serves dual purposes: handling netlink deletion templates (which own a temporary tree reference) and internal fsnotify autoremove events (which pass the installed rule entry itself). The unconditional audit_put_tree() call at the end of audit_del_rule() incorrectly assumes the template case for both paths. For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify autoremove event drops the live tree reference of the installed rule; if multiple rules share the same tree, this can free the tree while another rule still holds a reference, causing a subsequent autoremove to dereference the freed pathname during rule comparison. The fix moves the temporary-tree put to audit_rule_change() — the caller that owns deletion templates — while retaining cleanup in AUDIT_DEL_RULE for both successful deletion and -ENOENT cases (Red Hat CVE, Kernel Patch).

Successful exploitation of this vulnerability can cause kernel memory corruption due to a use-after-free condition in the audit subsystem, potentially leading to a kernel panic (denial of service) or, in more severe scenarios, privilege escalation if the freed memory is reclaimed and controlled by an attacker. The vulnerability is triggered in the context of audit rule management with mixed AUDIT_DIR and AUDIT_EXE rules, which typically requires local access and the ability to manipulate audit rules. Availability is the primary concern, though integrity and confidentiality impacts cannot be fully excluded in exploitation scenarios involving controlled memory reuse (Red Hat CVE).

There are no known public proof-of-concept exploits, no reported in-the-wild exploitation, and no threat actor attribution associated with CVE-2026-89643 at this time. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a system with audit rules configured using both AUDIT_DIR and AUDIT_EXE directives (Red Hat CVE).

Patches have been applied to the following stable Linux kernel versions: 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. Administrators should update to one of these patched versions as soon as possible. The specific fix commits are cf37b61b5420fd4600fe78cf8c24da6e4d9bfe28, 636a99bab36ba27515363d325866c0273ac83b3e, 583cf579b32d99e3fe4e9c8ecc4d852e3708fbec, and 783f0f0974c156aca630f4ffff248671082a098d. As a short-term workaround, avoiding the use of mixed AUDIT_DIR plus AUDIT_EXE audit rules on unpatched systems can reduce exposure (Red Hat CVE, Kernel Patch).