Executive brief
AppArmor is a mandatory access control (MAC) security module integrated into the Linux kernel that enforces application sandboxing policies. A bug in the AppArmor file path handling code can cause the kernel to crash when an uninitialized pointer is dereferenced during file permission auditing, resulting in a denial of service affecting system stability.
Technical details
The vulnerability is a use-of-uninitialized-variable bug in the AppArmor security module. Commit 4a134723f9f1 introduced a logic flaw where the path_name() function may pass an uninitialized pointer to aa_audit_file() when a dentry is replaced with aa_null.dentry. This uninitialized pointer is subsequently passed to audit_log_untrustedstring(), which calls strlen() on it, causing a kernel page fault and crash. The bug is triggered during normal file operations on systems with AppArmor enabled (no special authentication or privileges required for triggering from userspace via file operations). The fix initializes variables passed down through the path_name() call chain to prevent the uninitialized pointer from being used.
Affected products
- Linux Linux kernel 7.0.2 and potentially earlier versions
Timeline
- 2026-08-15: disclosed: CVE-2026-72455 published