Executive brief
AppArmor is a Linux kernel security module that enforces mandatory access control policies. A bug in the aa_change_profile() function could allow a local attacker to cause a kernel crash by dereferencing a null or invalid pointer, resulting in a denial of service.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the Linux kernel's AppArmor security module. In aa_change_profile(), the function fn_label_build_in_scope() builds a replacement label and can return NULL or an ERR_PTR on failure. However, this result was passed to aa_label_is_unconfined_subset() before validation with IS_ERR_OR_NULL(), allowing dereferencing of an invalid pointer. The fix moves the error check immediately after the label build, before the no_new_privs subset check. Local kernel code path execution is required, and exploitation results in a kernel panic (denial of service).
Affected products
- Linux Linux kernel 5.3 and later (multiple stable branches)
Timeline
- 2026-08-15: disclosed
- 2026-06-08: patched: Upstream fix committed
- 2026-07-24: other: Backported to stable kernel branches