Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel < 6.6.157.1‑1 may release resources too early
published 1 month ago
Summary
Versions of the Linux kernel older than 6.6.157.1‑1 can mistakenly free internal data structures while they are still needed, which can lead to system instability or crashes. The problem occurs when certain audit rules are removed. Update the kernel to the latest release or apply the provided patch to correct the cleanup process.
What to do
- Update kernel to version 6.6.157.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | kernel | <= 6.6.150.1-1 |
| Azure Linux:3 | – | kernel |
<= 6.6.152.1-1 < 6.6.157.1-1 Fix: upgrade to 6.6.157.1-1
|
Original advisory text
CVE-2026-89643 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved:
audit: avoid dropping live tree ref on fsnotify rule autoremove
audit_del_rule() is used for both netlink deletion templates and internal
fsnotify autoremove. The former passes a parsed template which owns a
temporary tree reference; the latter passes the installed entry itself.
The unconditional audit_put_tree() at the end of audit_del_rule() assumes
the template case. For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify
autoremove event therefore drops the installed rule's live tree reference.
Repeating this across rules sharing the same tree can free the tree while
another rule still references it, and a later autoremove dereferences the
freed pathname while comparing rules.
Move the temporary-tree put to audit_rule_change(), the caller that owns
deletion templates. Keep it in the AUDIT_DEL_RULE cleanup so both
successful deletion and -ENOENT still release the parser-owned tree.
[PM: dropped unnecessary comment for line length reasons]
audit: avoid dropping live tree ref on fsnotify rule autoremove
audit_del_rule() is used for both netlink deletion templates and internal
fsnotify autoremove. The former passes a parsed template which owns a
temporary tree reference; the latter passes the installed entry itself.
The unconditional audit_put_tree() at the end of audit_del_rule() assumes
the template case. For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify
autoremove event therefore drops the installed rule's live tree reference.
Repeating this across rules sharing the same tree can free the tree while
another rule still references it, and a later autoremove dereferences the
freed pathname while comparing rules.
Move the temporary-tree put to audit_rule_change(), the caller that owns
deletion templates. Keep it in the AUDIT_DEL_RULE cleanup so both
successful deletion and -ENOENT still release the parser-owned tree.
[PM: dropped unnecessary comment for line length reasons]
References
Timeline
Published11 Sep 2026
Updated2 Oct 2026
First seen23 Sep 2026
Sources
AZL-100316 · OSV
Track software like this
Free during beta