Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel before 6.6.152.1-1 can free audit data prematurely
published 2 months ago
Summary
The Linux kernel versions earlier than 6.6.152.1-1 have a flaw in the audit subsystem that can release memory while it is still being used, potentially leading to crashes or unstable behavior when audit rules are deleted. Updating the kernel to a version that includes the fix eliminates this risk. Apply the latest kernel patches as soon as possible.
What to do
- Update kernel to version 6.6.152.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | kernel | <= 6.6.150.1-1 |
| Azure Linux:3 | – | kernel |
< 6.6.152.1-1 Fix: upgrade to 6.6.152.1-1
|
Original advisory text
CVE-2026-74512 affecting package kernel for versions less than 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved:
audit: fix potential use-after-free in audit_del_rule()
`audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()`
before unlinking the rule from RCU-visible filter lists and waiting for a
grace period. Concurrent readers in `audit_filter()` and
`audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify
mark can be freed on an independent lifetime path. This creates a
use-after-free window during rule deletion.
Fix this by unlinking the rule from the RCU-visible lists and invoking
`synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other
rule removal helpers). This ensures that all existing RCU readers have
exited the critical section before any underlying resources are destroyed.
audit: fix potential use-after-free in audit_del_rule()
`audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()`
before unlinking the rule from RCU-visible filter lists and waiting for a
grace period. Concurrent readers in `audit_filter()` and
`audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify
mark can be freed on an independent lifetime path. This creates a
use-after-free window during rule deletion.
Fix this by unlinking the rule from the RCU-visible lists and invoking
`synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other
rule removal helpers). This ensures that all existing RCU readers have
exited the critical section before any underlying resources are destroyed.
References
Timeline
Published15 Aug 2026
Updated2 Oct 2026
First seen23 Sep 2026
Sources
AZL-96540 · OSV
Track software like this
Free during beta