Critical Vulnerability in Linux Kernel: Audit Rule Reference Management Issue
Summary
DEBIAN-CVE-2026-89643: In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove audit_del_rule() is used for both netlink deletion templates and internal fsnotify autor... Affects linux versions 6.1.106-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It is widely used across various distributions, including Debian. This vulnerability affects the kernel's audit subsystem, which is responsible for tracking security-relevant events. The kernel's ability to manage audit rules effectively is crucial for maintaining system security and integrity.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the audit subsystem related to the management of audit rules. Specifically, the function audit_del_rule() improperly handles the deletion of audit rules, leading to a situation where a live tree reference can be dropped. This occurs when an fsnotify autoremove event is triggered for mixed AUDIT_DIR and AUDIT_EXE rules, potentially freeing the tree while another rule still references it. As a result, subsequent dereferences can lead to undefined behavior, including system crashes or security breaches. The vulnerability has been assigned a CVSS score of 9.8, indicating its critical nature and potential impact on system security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the necessary updates as soon as they are available.
Conclusion
The vulnerability in the Linux kernel's audit subsystem poses a significant risk to system security due to improper handling of audit rule references. Users are strongly advised to update their kernel to the latest patched version to mitigate potential threats. Regular monitoring and prompt updates are essential for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper management of audit rule references in the Linux kernel, which can lead to system instability and security risks.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
While there are no specific workarounds, it is crucial to prioritize updating your kernel to mitigate the risk associated with this vulnerability.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
Detailed information about this vulnerability can be found in the Debian security advisories and the official CVE database.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
