---
id: CVE-2026-89600
title: 'fanotify: fix use-after-free of file range info'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fanotify: fix use-after-free of file range info

  fsnotify_pre_content() builds its file_range on the triggering task's
  stack. fanotify_alloc_perm_event() saves a pointe…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 870499bc1d4dc04cba1f63dd5e7bc02b983e2458 <
    66aa9a9e6481bfa512ee5b6380eaaec455a954d2
  - >-
    Linux >= 870499bc1d4dc04cba1f63dd5e7bc02b983e2458 <
    b8f73b163b646bc56d4dce9c697a578e333f4894
  - >-
    Linux >= 870499bc1d4dc04cba1f63dd5e7bc02b983e2458 <
    d7f1cf5be33ef0175a4e8ed8687aeb98fb00a851
  - Linux 6.14
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:49:32.566Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89600'
references:
  - url: 'https://git.kernel.org/stable/c/66aa9a9e6481bfa512ee5b6380eaaec455a954d2'
  - url: 'https://git.kernel.org/stable/c/b8f73b163b646bc56d4dce9c697a578e333f4894'
  - url: 'https://git.kernel.org/stable/c/d7f1cf5be33ef0175a4e8ed8687aeb98fb00a851'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89600.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89600'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532299'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89600'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89600'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89600.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00124
epssPercentile: 0.02096
scores:
  cna: 7.8
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.474Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fanotify: fix use-after-free of file range info

fsnotify_pre_content() builds its file_range on the triggering task's
stack. fanotify_alloc_perm_event() saves a pointer to range.pos in the
heap-allocated permission event so copy_range_info_to_user() can report
the offset later.

The event reader can set the event state to FAN_EVENT_REPORTED and then
sleep while preparing the file descriptor. If a signal interrupts the
triggering task at that point, fanotify_get_response() changes the state
to FAN_EVENT_CANCELED and returns. This unwinds the file_range stack
frame while the reader still owns the event. The reader then dereferences
pevent->ppos and copies the stale stack value to userspace.

KASAN reported:

  BUG: KASAN: use-after-free in fanotify_read+0x293e/0x2970
  Read of size 8 at addr ffff88811434fc50 by task fanotify_inotif/95
  Call Trace:
   fanotify_read+0x293e/0x2970
   vfs_read+0x177/0xa20
   ksys_read+0xf7/0x1c0
   do_syscall_64+0xf9/0x540
   entry_SYSCALL_64_after_hwframe+0x77/0x7f

Store the range position directly in the permission event and use
FANOTIFY_NO_RANGE when range information is unavailable. The event remains
alive until the reader finishes, so the reported offset no longer depends
on the triggering task's stack.

## Affected

- `Linux >= 870499bc1d4dc04cba1f63dd5e7bc02b983e2458 < 66aa9a9e6481bfa512ee5b6380eaaec455a954d2`
- `Linux >= 870499bc1d4dc04cba1f63dd5e7bc02b983e2458 < b8f73b163b646bc56d4dce9c697a578e333f4894`
- `Linux >= 870499bc1d4dc04cba1f63dd5e7bc02b983e2458 < d7f1cf5be33ef0175a4e8ed8687aeb98fb00a851`
- `Linux 6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89600.json)