Executive brief
AppArmor is a Linux security module that restricts program capabilities. A bug in complain mode can cause processes to deadlock and become unkillable when changing security contexts (hats) for missing profiles, effectively causing a denial of service to the affected application and potentially the system.
Technical details
A classic deadlock vulnerability exists in the Linux kernel's AppArmor security module when processing change_hat() calls in complain mode. The root cause is that change_hat() holds a lock while searching the hat list, and if a missing profile is encountered, aa_new_learning_profile() attempts to acquire the same lock to add the new learning profile to the list. The vulnerability is triggered when AppArmor is in complain mode and a process attempts to change to a non-existent hat (security profile), such as via pam_apparmor. The impact is that the affected process becomes deadlocked and unkillable, and subsequent hat changes also deadlock. The fix involves refactoring aa_new_learning_profile() to separate locking concerns and have build_change_hat() call an unlocked core function, along with fixing related reference count leaks introduced in a prior commit.
Affected products
- Linux Linux kernel 7.2-rc7, 7.0.0, and earlier; unaffected in 6.12.95 with Debian patches
Timeline
- 2026-09-17: disclosed