CVE-2026-72459 (GCVE-0-2026-72459)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:44
VLAI
Title
apparmor: aa_label_alloc use aa_label_free on alloc failure
Summary
In the Linux kernel, the following vulnerability has been resolved: apparmor: aa_label_alloc use aa_label_free on alloc failure aa_label_alloc() allocates a secid before allocating or taking the label proxy. If the later proxy step fails, the error path only freed the label memory, leaking any resources initialized by aa_label_init(). Use aa_label_free() on the failure path so partially initialized labels release their secid and other label resources before the backing memory is freed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f1bd904175e8190ce14aedee37e207ab51fe3b30 , < b14fbacad77d64594228983ec20d61a224f3f491 (git)
Affected: f1bd904175e8190ce14aedee37e207ab51fe3b30 , < b5a9da5d36162d34db0f36abb15420e295176793 (git)
Affected: f1bd904175e8190ce14aedee37e207ab51fe3b30 , < 7cb69e109610bba500e1ecb870f7988a4717208a (git)
Affected: f1bd904175e8190ce14aedee37e207ab51fe3b30 , < cc2192899d502e3321e60cf1e91421e7309d089c (git)
Affected: f1bd904175e8190ce14aedee37e207ab51fe3b30 , < bf310b044e85d4de670c94295c5d8e4c5bc5e7bc (git)
Affected: f1bd904175e8190ce14aedee37e207ab51fe3b30 , < ae02e603c0b39b29f3ce6fe3efe01b286af1a2a4 (git)
Affected: f1bd904175e8190ce14aedee37e207ab51fe3b30 , < 6d91479174240f39e9edea250d95fa08c678a207 (git)
Affected: f1bd904175e8190ce14aedee37e207ab51fe3b30 , < 654fe7505dc6889724d4094fa64f89991afabfc3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/label.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b14fbacad77d64594228983ec20d61a224f3f491",
              "status": "affected",
              "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
              "versionType": "git"
            },
            {
              "lessThan": "b5a9da5d36162d34db0f36abb15420e295176793",
              "status": "affected",
              "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
              "versionType": "git"
            },
            {
              "lessThan": "7cb69e109610bba500e1ecb870f7988a4717208a",
              "status": "affected",
              "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
              "versionType": "git"
            },
            {
              "lessThan": "cc2192899d502e3321e60cf1e91421e7309d089c",
              "status": "affected",
              "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
              "versionType": "git"
            },
            {
              "lessThan": "bf310b044e85d4de670c94295c5d8e4c5bc5e7bc",
              "status": "affected",
              "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
              "versionType": "git"
            },
            {
              "lessThan": "ae02e603c0b39b29f3ce6fe3efe01b286af1a2a4",
              "status": "affected",
              "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
              "versionType": "git"
            },
            {
              "lessThan": "6d91479174240f39e9edea250d95fa08c678a207",
              "status": "affected",
              "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
              "versionType": "git"
            },
            {
              "lessThan": "654fe7505dc6889724d4094fa64f89991afabfc3",
              "status": "affected",
              "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/label.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: aa_label_alloc use aa_label_free on alloc failure\n\naa_label_alloc() allocates a secid before allocating or taking the label\nproxy. If the later proxy step fails, the error path only freed the label\nmemory, leaking any resources initialized by aa_label_init().\n\nUse aa_label_free() on the failure path so partially initialized labels\nrelease their secid and other label resources before the backing memory is\nfreed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in AppArmor LSM label allocation reached only through local kernel entry points (open/read/exec, unix socket mediation, change_hat/change_profile procattr) on AppArmor-enabled systems, not via remote network packet handling.\nAC:L - Triggering proxy allocation failure after secid allocation requires memory pressure, but an attacker can reliably induce kmalloc/GFP_ATOMIC exhaustion locally (memfd, large mappings, stress) while driving aa_label_merge through routine file or socket operations.\nPR:L - Any unprivileged local process running under AppArmor (default on Ubuntu, Debian, SUSE, Android) can reach aa_label_merge/aa_label_alloc through normal permitted file access, exec domain transitions, or unix-socket mediation without real-root or CAP_MAC_ADMIN.\nUI:N - Exploitation requires no victim or administrator interaction; the attacker uses only their own credentials and syscalls to create memory pressure and invoke AppArmor label-merge paths.\nS:U - Impact is kernel memory corruption, information disclosure, and denial of service within the host kernel security domain; it does not cross a VM, container, or IOMMU security boundary by itself.\nC:H - The error path called kfree() without aa_free_secid(), leaving the global secid xarray pointing at freed aa_label memory; aa_secid_to_label()/apparmor_secid_to_secctx() then dereference attacker-influenced freed slab for arbitrary kernel memory reads.\nI:H - Orphaned secid entries retain dangling aa_label pointers whose vec/profile fields can be reclaimed and sprayed; UAF traversal of those structures is a standard path to heap control and arbitrary kernel writes or code execution.\nA:H - Dereferencing stale label/profile pointers can cause kernel oops/panic, and each successful trigger permanently leaks a secid slot until reboot, eventually exhausting the global secid table and denying all future AppArmor label creation system-wide."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:25.217Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b14fbacad77d64594228983ec20d61a224f3f491"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5a9da5d36162d34db0f36abb15420e295176793"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cb69e109610bba500e1ecb870f7988a4717208a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc2192899d502e3321e60cf1e91421e7309d089c"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf310b044e85d4de670c94295c5d8e4c5bc5e7bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae02e603c0b39b29f3ce6fe3efe01b286af1a2a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d91479174240f39e9edea250d95fa08c678a207"
        },
        {
          "url": "https://git.kernel.org/stable/c/654fe7505dc6889724d4094fa64f89991afabfc3"
        }
      ],
      "title": "apparmor: aa_label_alloc use aa_label_free on alloc failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72459",
    "datePublished": "2026-08-15T05:57:04.794Z",
    "dateReserved": "2026-08-09T03:40:39.932Z",
    "dateUpdated": "2026-08-17T05:44:25.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72459",
      "date": "2026-09-22",
      "epss": "0.00139",
      "percentile": "0.0362"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "security/apparmor/label.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b14fbacad77d64594228983ec20d61a224f3f491",
                    "status": "affected",
                    "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b5a9da5d36162d34db0f36abb15420e295176793",
                    "status": "affected",
                    "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7cb69e109610bba500e1ecb870f7988a4717208a",
                    "status": "affected",
                    "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cc2192899d502e3321e60cf1e91421e7309d089c",
                    "status": "affected",
                    "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bf310b044e85d4de670c94295c5d8e4c5bc5e7bc",
                    "status": "affected",
                    "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ae02e603c0b39b29f3ce6fe3efe01b286af1a2a4",
                    "status": "affected",
                    "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6d91479174240f39e9edea250d95fa08c678a207",
                    "status": "affected",
                    "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "654fe7505dc6889724d4094fa64f89991afabfc3",
                    "status": "affected",
                    "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "security/apparmor/label.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.13"
                  },
                  {
                    "lessThan": "4.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: aa_label_alloc use aa_label_free on alloc failure\n\naa_label_alloc() allocates a secid before allocating or taking the label\nproxy. If the later proxy step fails, the error path only freed the label\nmemory, leaking any resources initialized by aa_label_init().\n\nUse aa_label_free() on the failure path so partially initialized labels\nrelease their secid and other label resources before the backing memory is\nfreed."
          }
        ],
        "id": "CVE-2026-72459",
        "lastModified": "2026-08-17T06:19:13.530",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:19.877",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/654fe7505dc6889724d4094fa64f89991afabfc3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6d91479174240f39e9edea250d95fa08c678a207"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7cb69e109610bba500e1ecb870f7988a4717208a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ae02e603c0b39b29f3ce6fe3efe01b286af1a2a4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b14fbacad77d64594228983ec20d61a224f3f491"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b5a9da5d36162d34db0f36abb15420e295176793"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bf310b044e85d4de670c94295c5d8e4c5bc5e7bc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cc2192899d502e3321e60cf1e91421e7309d089c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T06:53:16+00:00",
      "cve": "CVE-2026-72459",
      "id": "CVE-2026-72459",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: apparmor: aa_label_alloc use aa_label_free on alloc failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72459.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:38:01Z",
      "cve": "CVE-2026-72459",
      "id": "CVE-2026-72459",
      "initial_release_date": "2026-08-27T16:52:31Z",
      "product_status:first_fixed": "60",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72459",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72459.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.