{"id":21522,"date":"2026-09-12T04:31:18","date_gmt":"2026-09-11T20:31:18","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89600"},"modified":"2026-09-12T04:31:18","modified_gmt":"2026-09-11T20:31:18","slug":"cve-2026-89600","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89600","title":{"rendered":"CVE-2026-89600 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nfanotify: fix use-aft"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fanotify: fix use-after-free of file range info<\/p>\n<p>fsnotify_pre_content() builds its file_range on the triggering task&#8217;s<br \/>\nstack. fanotify_alloc_perm_event() saves a pointer to range.pos in the<br \/>\nheap-allocated permission event so copy_range_info_to_user() can report<br \/>\nthe offset later.<\/p>\n<p>The event reader can set the event state to FAN_EVENT_REPORTED and then<br \/>\nsleep while preparing the file descriptor. If a signal interrupts the<br \/>\ntriggering task at that point, fanotify_get_response() changes the state<br \/>\nto FAN_EVENT_CANCELED and returns. This unwinds the file_range stack<br \/>\nframe while the reader still owns the event. The reader then dereferences<br \/>\npevent-&gt;ppos and copies the stale stack value to userspace.<\/p>\n<p>KASAN reported:<\/p>\n<p>  BUG: KASAN: use-after-free in fanotify_read+0x293e\/0x2970<br \/>\n  Read of size 8 at addr ffff88811434fc50 by task fanotify_inotif\/95<br \/>\n  Call Trace:<br \/>\n   fanotify_read+0x293e\/0x2970<br \/>\n   vfs_read+0x177\/0xa20<br \/>\n   ksys_read+0xf7\/0x1c0<br \/>\n   do_syscall_64+0xf9\/0x540<br \/>\n   entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n<p>Store the range position directly in the permission event and use<br \/>\nFANOTIFY_NO_RANGE when range information is unavailable. The event remains<br \/>\nalive until the reader finishes, so the reported offset no longer depends<br \/>\non the triggering task&#8217;s stack.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fanotify: fix use-after-free of file range info<\/p>\n<p>fsnotify_pre_content() builds its file_range on the triggering task&#8217;s<br \/>\nstack. fanot<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21522","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21522","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21522"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21522"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}