CVE-2026-89643

A flaw was found in the Linux kernel's audit subsystem. When fsnotify rules are automatically removed, the system incorrectly manages memory references, leading to a situation where freed memory can be accessed again. This memory corruption vulnerability could allow a local attacker to cause a system crash, leading to a denial of service.

Red Hat rates this vulnerability as Moderate severity rather than Important because successful exploitation requires local system access and non-standard audit rule definitions combining directory and executable watches. The flaw occurs in the Linux kernel audit subsystem when automated filesystem notification cleanup mishandles reference counts across shared rule trees. Under standard deployments without these overlapping audit criteria, the vulnerable condition cannot be triggered, substantially limiting real-world impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.