Executive brief
AppArmor is a security framework built into the Linux kernel that enforces mandatory access control policies. A race condition in its Unix socket mediation logic could allow concurrent socket operations to access deallocated memory, potentially leading to kernel crashes or information disclosure. Systems running affected kernel versions with AppArmor enabled are at risk.
Technical details
A race condition exists in AppArmor's unix socket mediation code (security/apparmor/af_unix.c) where the peer socket path is accessed outside of the state lock. An attacker can exploit this by causing a concurrent unix_release_sock() call to deallocate the peer socket while AppArmor is reading its path, leading to use-after-free or null pointer dereference. The fix acquires the unix state lock before accessing and referencing the peer socket path, ensuring atomic access. The vulnerability was introduced by commit bc6e5f6933b8e which removed double locking.
Affected products
- Linux Linux Kernel Multiple versions (see git history); patch backported across stable branches linux-3.x through linux-7.x
Timeline
- 2026-08-15: disclosed: CVE-2026-72462 published
- 2025-10-24: patched: Original fix committed by John Johansen