Executive brief
The Linux kernel's AppArmor security module had a resource leak in code that retrieves the path to the currently executing process. If the path resolution operation failed, file and path references were not properly cleaned up, wasting kernel memory. The fix ensures cleanup routines always execute, preventing gradual memory exhaustion on systems using AppArmor.
Technical details
This is a resource leak vulnerability in the AppArmor security module's get_current_exe_path() function within security/apparmor/task.c. The function acquires both an exe_file reference and a path reference via path_get(), then calls aa_path_name() to resolve the pathname. If aa_path_name() fails and returns an error, the function previously returned immediately without releasing those acquired references, causing fput() and path_put() to never execute. The fix routes all failure paths through a common cleanup section (labeled "out:") to ensure both fput(exe_file) and path_put(&p) always run after references are acquired. No user interaction or special privileges are required to trigger this; any activity that exercises AppArmor's executable path tracking can cause the leak.
Affected products
- Linux Linux kernel multiple versions (patched by commit 7306c41672487a6c28430714be063bc6942c28f2)
Timeline
- 2026-08-15: disclosed: CVE published
- 2026-05-04: patched: Fix committed upstream by Zygmunt Krynicki
- 2026-06-13: patched: Merged into mainline
- 2026-07-24: patched: Backported to stable kernel trees