CVE-2026-98862: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98862 is a use-after-free (UAF) vulnerability in the Linux kernel's audit subsystem, specifically within the kill_rules() function. It affects Linux kernel versions from 4.3 onward, with fixes available in versions 6.12.113, 6.18.56, 7.2.10, and 7.3-rc6. The vulnerability arises when kill_rules() drops entry->rule.exe before removing the rule from RCU-visible filter lists, creating a race condition that can lead to kernel memory corruption or a crash. The CVSS base score is currently listed as 0.0 with a medium severity estimate, and the CVE was published on October 18, 2026 (GitHub Advisory, Feedly).

The root cause is a race condition (CWE-416: Use After Free) in the kill_rules() function of the Linux kernel audit subsystem. When an audit tree is pruned, kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules but incorrectly drops entry->rule.exe before unlinking the rule from the RCU-visible filter lists. A concurrent task evaluating the rule can reach audit_mark_compare() after fsnotify has already freed the executable mark, triggering a slab-use-after-free as confirmed by KASAN: BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0. Exploitation requires CAP_AUDIT_CONTROL privilege (typically root) to first install an audit rule via AUDIT_ADD_RULE, then trigger the race by removing the watched directory (GitHub Advisory).

Successful exploitation can cause a kernel crash (denial of service) or memory corruption on the affected system. Because the vulnerability is local and requires CAP_AUDIT_CONTROL, the blast radius is limited to privileged local users or processes; however, memory corruption in kernel space could theoretically be leveraged for privilege escalation in more complex attack chains. Confidentiality and integrity impacts are secondary to the primary availability impact of a kernel panic (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, reflecting a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for CAP_AUDIT_CONTROL privileges, significantly limiting the attacker population.

1. Privilege acquisition: Obtain a local session with CAP_AUDIT_CONTROL capability (typically requires root or an equivalent privileged account on the target Linux system).
2. Install audit rule: Use auditctl or the AUDIT_ADD_RULE netlink interface to install an audit rule that combines AUDIT_DIR and AUDIT_EXE filters, associating a watched directory with an executable mark.
3. Trigger concurrent evaluation: Initiate a workload or process that causes the kernel to evaluate the installed audit rule (e.g., executing a binary within the watched directory) so that a reader task is actively in audit_mark_compare().
4. Remove watched directory: Simultaneously remove the watched directory (e.g., rmdir or rm -rf) to trigger audit tree pruning and invoke kill_rules().
5. Race condition triggers UAF: If the race is won, fsnotify frees the executable mark while the reader is still in audit_mark_compare(), causing a use-after-free that results in a kernel crash or memory corruption (GitHub Advisory).

• Logs: Kernel logs (dmesg or /var/log/kern.log) containing BUG: KASAN: slab-use-after-free in audit_mark_compare or related kernel panic traces.
• Logs: Unexpected kernel oops or crash reports referencing kill_rules(), audit_mark_compare(), or fsnotify in the audit subsystem stack trace.
• Process: Unusual or repeated invocations of auditctl with AUDIT_ADD_RULE followed by rapid directory removal operations by a privileged process.
• File System: Unexpected removal of directories that were previously registered as audit watch targets (auditctl -l showing rules that disappear unexpectedly).

Apply the available kernel patches: fixes are included in Linux kernel versions 6.12.113, 6.18.56, 7.2.10, and 7.3-rc6. The fix unlinking published rules from RCU-visible lists before removing executable marks and adds a synchronous RCU grace period wait when executable marks are present. As a workaround, restrict CAP_AUDIT_CONTROL capabilities strictly to trusted administrators to reduce the attack surface. Downstream Linux distributions should be monitored for backported patches to their respective stable kernels (GitHub Advisory, Feedly).