{"id":21565,"date":"2026-09-12T04:31:21","date_gmt":"2026-09-11T20:31:21","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89643"},"modified":"2026-09-12T04:31:21","modified_gmt":"2026-09-11T20:31:21","slug":"cve-2026-89643","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89643","title":{"rendered":"CVE-2026-89643 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\naudit: avoid dropping"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>audit: avoid dropping live tree ref on fsnotify rule autoremove<\/p>\n<p>audit_del_rule() is used for both netlink deletion templates and internal<br \/>\nfsnotify autoremove.  The former passes a parsed template which owns a<br \/>\ntemporary tree reference; the latter passes the installed entry itself.<\/p>\n<p>The unconditional audit_put_tree() at the end of audit_del_rule() assumes<br \/>\nthe template case.  For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify<br \/>\nautoremove event therefore drops the installed rule&#8217;s live tree reference.<br \/>\nRepeating this across rules sharing the same tree can free the tree while<br \/>\nanother rule still references it, and a later autoremove dereferences the<br \/>\nfreed pathname while comparing rules.<\/p>\n<p>Move the temporary-tree put to audit_rule_change(), the caller that owns<br \/>\ndeletion templates.  Keep it in the AUDIT_DEL_RULE cleanup so both<br \/>\nsuccessful deletion and -ENOENT still release the parser-owned tree.<\/p>\n<p>[PM: dropped unnecessary comment for line length reasons]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>audit: avoid dropping live tree ref on fsnotify rule autoremove<\/p>\n<p>audit_del_rule() is used for both netlink deletion templates and i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21565","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21565","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21565"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21565"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21565"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}