CVE-2026-68096

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

audit: fix recursive locking deadlock in audit_dupe_exe()

A deadlock occurs in the audit subsystem when duplicating

executable-related rules.

When a file is moved (e.g., via do_renameat2()), the VFS layer locks

the parent directory (I_MUTEX_PARENT), which synchronously triggers an

fsnotify_move event. If an existing executable audit rule matches the

file being moved, the audit subsystem catches this event and calls

audit_dupe_exe() to duplicate the watch and update the rule. Then,

audit_alloc_mark() would call kern_path_parent() to resolve the path,

leading to a blind attempt to acquire the exact same I_MUTEX_PARENT lock

already held by the task, resulting in the following recursive locking

deadlock:

============================================

WARNING: possible recursive locking detected

6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted

--------------------------------------------

mv/5099 is trying to acquire

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References