CVE-2026-68096

A flaw was found in the Linux kernel's audit subsystem. A local user can trigger a recursive locking deadlock by moving a file that has an existing executable audit rule. This occurs when the audit subsystem attempts to acquire a lock that is already held, leading to a system-wide deadlock. This vulnerability can result in a Denial of Service (DoS) for the affected system.

This vulnerability is rated as Moderate severity because it requires local access and the presence of specific audit rules configured to monitor executable file paths. Although an unprivileged local user who renames or moves a watched file can induce an unrecoverable kernel deadlock resulting in a denial of service, the flaw does not facilitate privilege escalation or data compromise. Furthermore, default Red Hat Enterprise Linux installations are not exposed unless custom executable-based audit rules have been established by an administrator.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.