Description
In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in audit_del_rule() `audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()` before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in `audit_filter()` and `audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify mark can be freed on an independent lifetime path. This creates a use-after-free window during rule deletion. Fix this by unlinking the rule from the RCU-visible lists and invoking `synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other rule removal helpers). This ensures that all existing RCU readers have exited the critical section before any underlying resources are destroyed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
34d99af52ad40bd498ba66970579a5bc1fb1a3bc to < 93616c567469510b7bba55b2674e0c4523fd7e64affected34d99af52ad40bd498ba66970579a5bc1fb1a3bc to < 3f82927b399d7a276c0c12b6ff4424b747a0c9a7affected34d99af52ad40bd498ba66970579a5bc1fb1a3bc to < 8ae135a8962be9d4e8a131eb18eb06cdf02a47ceaffected34d99af52ad40bd498ba66970579a5bc1fb1a3bc to < 45bf3df5b32e5a49953e7ceabc55f7dd85380e46affected34d99af52ad40bd498ba66970579a5bc1fb1a3bc to < 78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbfaffected34d99af52ad40bd498ba66970579a5bc1fb1a3bc to < cae0dfed5d307b240bff71c3cf206652d1b6f215affected34d99af52ad40bd498ba66970579a5bc1fb1a3bc to < 5b8f46864f06d6dbacb7dcea52bc084dfd122638affected34d99af52ad40bd498ba66970579a5bc1fb1a3bc to < 246df90b5f1a8a6e6abbd2f058b029558720adecaffected
Linux Linux
Default version status: affected
4.3affected0 to < 4.3unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.151 to ≤ 6.6.*unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/93616c567469510b7bba55b2674e0c4523fd7e64 ↗
- https://git.kernel.org/stable/c/3f82927b399d7a276c0c12b6ff4424b747a0c9a7 ↗
- https://git.kernel.org/stable/c/8ae135a8962be9d4e8a131eb18eb06cdf02a47ce ↗
- https://git.kernel.org/stable/c/45bf3df5b32e5a49953e7ceabc55f7dd85380e46 ↗
- https://git.kernel.org/stable/c/78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbf ↗
- https://git.kernel.org/stable/c/cae0dfed5d307b240bff71c3cf206652d1b6f215 ↗
- https://git.kernel.org/stable/c/5b8f46864f06d6dbacb7dcea52bc084dfd122638 ↗
- https://git.kernel.org/stable/c/246df90b5f1a8a6e6abbd2f058b029558720adec ↗