Executive brief
AppArmor is a mandatory access control (MAC) security framework in the Linux kernel that enforces security policies for applications. A resource leak vulnerability in the label allocation function can cause memory and file descriptor leaks, potentially leading to denial of service by exhausting kernel resources over time.
Technical details
The vulnerability is a resource leak (CWE-404) in the aa_label_alloc() function within the AppArmor security module. The function allocates a security ID (secid) and initializes label resources via aa_label_init() before taking a label proxy; if the proxy allocation fails, the error path only calls kfree() on the label memory, leaving initialized resources (secid and other label fields) unreleased. The fix replaces kfree() with aa_label_free() on the failure path to properly release all associated resources. This is a local kernel-level issue with no network attack vector; exploitation requires the ability to trigger label allocation failures, which could be achieved through local resource exhaustion scenarios.
Affected products
- Linux Linux kernel Multiple versions (see stable tree branches linux-2.6.11.y through linux-7.2.y and rolling branches)
Timeline
- 2026-08-15: disclosed
- 2026-06-13: patched: Patch committed upstream by John Johansen
- 2026-07-24: other: Backported to stable kernels (commit 6d91479174240f39e9edea250d95fa08c678a207)