Executive brief
AppArmor is a Linux kernel security framework that enforces access control policies on applications. A NULL pointer dereference in the policy unpacking code could cause the kernel to crash if policy loading fails, leading to denial of service on systems relying on AppArmor for security enforcement.
Technical details
A NULL pointer dereference vulnerability exists in security/apparmor/policy_unpack.c in the unpack_pdb function. The vulnerability occurs because pdb->dfa (deterministic finite automaton) can be NULL if the unpack_dfa function fails, but the subsequent code attempts to dereference it without a NULL check. The fix adds a pdb->dfa NULL check before accessing pdb->dfa->tables[YYTD_ID_ACCEPT2]. The attack vector is local and requires the ability to load AppArmor policies, typically available only to privileged users. The patch has been merged and is available in the Linux kernel source tree.
Affected products
- Linux Linux kernel affected in AppArmor policy unpacking code; patched as of commit 7681ca43d2b1c776e62fe77e3167835fb1ab8319
Timeline
- 2026-05-06: disclosed
- 2026-06-13: patched