CVE-2026-89643
This is a Linux kernel audit bug that can occur when filesystem notification rules are removed automatically, particularly when directory and executable rules share an audit tree. The kernel may free pathname data still referenced by another rule, so a later rule comparison can try to use memory that has already been freed.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users may be affected, but the sources do not list specific affected products or versions.
Real-world impact
The issue may make kernel audit operations unstable by causing them to access memory after it has been freed.
Why this severity
The vulnerability has a critical CVSS score of 9.8. Its vector indicates exploitation over a network, with low complexity, no required privileges, no user interaction, and potential high impact on confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to a release that contains the audit rule reference-handling fix for CVE-2026-89643.
The Linux kernel source note states that the vulnerability has been resolved, but it does not provide an affected version, patch number, or vendor advisory.
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.