Executive brief
AppArmor is a security module in the Linux kernel that manages access control policies. A reference counting bug in the Unix socket labeling code can cause memory leaks when updating socket security contexts, potentially leading to kernel memory exhaustion and system instability over time.
Technical details
The vulnerability is a use-after-free refcount leak in the AppArmor security module's af_unix.c file. The update_sk_ctx() function transfers a plabel (policy label) reference to ctx->peer_lastupdate but the caller unconditionally puts (releases) the same reference, resulting in a double-decrement of the refcount. The fix adds aa_get_label() calls to increment the refcount before assignment, ensuring the reference count remains balanced. No authentication or network access is required; the bug is triggered during normal Unix socket labeling operations within the kernel. This is a local kernel memory leak that affects system stability.
Affected products
- Linux Linux kernel multiple kernel versions (affected versions not explicitly listed in advisory)
Timeline
- 2026-08-15: disclosed
- 2026-06-13: patched: Upstream patch commit 6d25e7b47616cb2db43351210929c8f19dc305a3
- 2025-10-24: other: Patch authored by John Johansen