CVE-2026-98862
kernel: audit: fix exe mark UAF in kill_rules()
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 18, 2026
Updated · October 24, 2026
Description
A flaw was found in the Linux kernel's audit subsystem. A race condition can occur when an audit directory tree is removed while another process evaluates executable audit rules, causing the kernel to access memory after it has been released (a use-after-free condition). A local user with audit control privileges could exploit this flaw to cause memory corruption, leading to a system crash and Denial of Service (DoS) or potentially escalate privileges.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.1CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-825 · Expired Pointer Dereference