Executive brief
A vulnerability was identified in the Linux kernel's AppArmor security module, which is responsible for restricting the capabilities of programs. A technical error in how file paths are processed could lead to a system crash or memory corruption when certain software updates or mount operations occur. This issue primarily affects system stability and the reliability of security enforcement on affected Linux distributions.
Technical details
A string buffer overrun exists in the AppArmor LSM due to a missing null terminator in the d_namespace_path function within security/apparmor/path.c. The issue was introduced during a conversion from strcpy() and manifests when AppArmor processes directory paths during mount operations, such as those triggered by snap-update-ns. Specifically, when appending a trailing slash to directory paths, the code failed to re-terminate the string, leading to a slab-out-of-bounds read in aa_dfa_match. An attacker or a specific system state could trigger this via the mount syscall, potentially leading to a kernel panic (KASAN detected) or memory corruption. Patches have been released to ensure proper string termination.
Affected products
- Linux Linux Kernel 7.0-rc4
Timeline
- 2026-03-27: disclosed: Vulnerability reported by Daniel J Blueman
- 2026-04-22: patched: Initial patch signed by AppArmor maintainer
- 2026-05-07: patched: Patch committed to stable tree
- 2026-05-27: advisory: NVD publication date