CVE-2026-74512

A flaw was found in the Linux kernel. During the deletion of audit rules, the audit_del_rule() function prematurely frees a resource while other kernel functions can still access it. This creates a use-after-free vulnerability, which a local attacker could potentially exploit to cause system instability, information disclosure, or potentially escalate privileges.

audit rule deletion can create a use after free window because audit_del_rule() may destroy rule exe related resources before the rule is removed from RCU visible filter lists and before existing RCU readers finish. Concurrent audit_filter() or audit_filter_rules() readers can still dereference e rule exe while the underlying fsnotify mark or related object has already been released. For the CVSS the PR:L is used in the paranoid score because a local actor may be able to influence audit activity and race timing in environments with delegated audit management, container root, or a privileged audit management service. The issue is not network reachable and requires local interaction with the audit subsystem. Impact is at least local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to kernel use after free, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.