A critical use-after-free vulnerability in the Linux kernel audit subsystem, caused by improper tree reference handling, may lead to memory corruption or arbitrary code execution.

The vulnerability exists in the audit subsystem where an unconditional call to audit_put_tree during fsnotify rule autoremove incorrectly drops a live tree reference. This flaw, which requires no authentication to trigger if reachable, allows a local or remote attacker to cause a use-after-free condition when rules share the same tree.

The potential for memory corruption in the core kernel presents a severe risk to system stability and security. Successful exploitation could lead to system crashes, denial of service, or potentially arbitrary code execution with kernel-level privileges. Given the CVSS score of 9.8, this vulnerability is categorized as critical, necessitating immediate attention to prevent unauthorized system compromise.

Immediate Action: Update your Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later as appropriate for your distribution's branch.

Proactive Monitoring: Monitor system logs for kernel oops or audit-related errors that may indicate exploitation attempts or memory instability.

Compensating Controls: Ensure that audit rules are strictly managed and minimize the use of complex AUDIT_DIR plus AUDIT_EXE configurations until the kernel is patched.

Public Exploit Available: Unknown

This vulnerability represents a significant flaw in the Linux audit subsystem that requires urgent remediation. Administrators should prioritize applying the provided kernel patches to all affected systems to eliminate the risk of memory corruption and potential escalation. Regular updates are critical to maintaining the integrity of the operating system kernel.