CVE-2026-72459

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72459", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.932Z", "datePublished": "2026-08-15T05:57:04.794Z", "dateUpdated": "2026-08-17T05:44:25.217Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:44:25.217Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: aa_label_alloc use aa_label_free on alloc failure\n\naa_label_alloc() allocates a secid before allocating or taking the label\nproxy. If the later proxy step fails, the error path only freed the label\nmemory, leaking any resources initialized by aa_label_init().\n\nUse aa_label_free() on the failure path so partially initialized labels\nrelease their secid and other label resources before the backing memory is\nfreed."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in AppArmor LSM label allocation reached only through local kernel entry points (open/read/exec, unix socket mediation, change_hat/change_profile procattr) on AppArmor-enabled systems, not via remote network packet handling.\nAC:L - Triggering proxy allocation failure after secid allocation requires memory pressure, but an attacker can reliably induce kmalloc/GFP_ATOMIC exhaustion locally (memfd, large mappings, stress) while driving aa_label_merge through routine file or socket operations.\nPR:L - Any unprivileged local process running under AppArmor (default on Ubuntu, Debian, SUSE, Android) can reach aa_label_merge/aa_label_alloc through normal permitted file access, exec domain transitions, or unix-socket mediation without real-root or CAP_MAC_ADMIN.\nUI:N - Exploitation requires no victim or administrator interaction; the attacker uses only their own credentials and syscalls to create memory pressure and invoke AppArmor label-merge paths.\nS:U - Impact is kernel memory corruption, information disclosure, and denial of service within the host kernel security domain; it does not cross a VM, container, or IOMMU security boundary by itself.\nC:H - The error path called kfree() without aa_free_secid(), leaving the global secid xarray pointing at freed aa_label memory; aa_secid_to_label()/apparmor_secid_to_secctx() then dereference attacker-influenced freed slab for arbitrary kernel memory reads.\nI:H - Orphaned secid entries retain dangling aa_label pointers whose vec/profile fields can be reclaimed and sprayed; UAF traversal of those structures is a standard path to heap control and arbitrary kernel writes or code execution.\nA:H - Dereferencing stale label/profile pointers can cause kernel oops/panic, and each successful trigger permanently leaks a secid slot until reboot, eventually exhausting the global secid table and denying all future AppArmor label creation system-wide."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/apparmor/label.c"], "versions": [{"version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "lessThan": "b14fbacad77d64594228983ec20d61a224f3f491", "status": "affected", "versionType": "git"}, {"version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "lessThan": "b5a9da5d36162d34db0f36abb15420e295176793", "status": "affected", "versionType": "git"}, {"version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "lessThan": "7cb69e109610bba500e1ecb870f7988a4717208a", "status": "affected", "versionType": "git"}, {"version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "lessThan": "cc2192899d502e3321e60cf1e91421e7309d089c", "status": "affected", "versionType": "git"}, {"version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "lessThan": "bf310b044e85d4de670c94295c5d8e4c5bc5e7bc", "status": "affected", "versionType": "git"}, {"version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "lessThan": "ae02e603c0b39b29f3ce6fe3efe01b286af1a2a4", "status": "affected", "versionType": "git"}, {"version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "lessThan": "6d91479174240f39e9edea250d95fa08c678a207", "status": "affected", "versionType": "git"}, {"version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "lessThan": "654fe7505dc6889724d4094fa64f89991afabfc3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/apparmor/label.c"], "versions": [{"version": "4.13", "status": "affected"}, {"version": "0", "lessThan": "4.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b14fbacad77d64594228983ec20d61a224f3f491"}, {"url": "https://git.kernel.org/stable/c/b5a9da5d36162d34db0f36abb15420e295176793"}, {"url": "https://git.kernel.org/stable/c/7cb69e109610bba500e1ecb870f7988a4717208a"}, {"url": "https://git.kernel.org/stable/c/cc2192899d502e3321e60cf1e91421e7309d089c"}, {"url": "https://git.kernel.org/stable/c/bf310b044e85d4de670c94295c5d8e4c5bc5e7bc"}, {"url": "https://git.kernel.org/stable/c/ae02e603c0b39b29f3ce6fe3efe01b286af1a2a4"}, {"url": "https://git.kernel.org/stable/c/6d91479174240f39e9edea250d95fa08c678a207"}, {"url": "https://git.kernel.org/stable/c/654fe7505dc6889724d4094fa64f89991afabfc3"}], "title": "apparmor: aa_label_alloc use aa_label_free on alloc failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["security/apparmor/label.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b14fbacad77d64594228983ec20d61a224f3f491", "status": "affected", "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "versionType": "git"}, {"lessThan": "b5a9da5d36162d34db0f36abb15420e295176793", "status": "affected", "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "versionType": "git"}, {"lessThan": "7cb69e109610bba500e1ecb870f7988a4717208a", "status": "affected", "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "versionType": "git"}, {"lessThan": "cc2192899d502e3321e60cf1e91421e7309d089c", "status": "affected", "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "versionType": "git"}, {"lessThan": "bf310b044e85d4de670c94295c5d8e4c5bc5e7bc", "status": "affected", "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "versionType": "git"}, {"lessThan": "ae02e603c0b39b29f3ce6fe3efe01b286af1a2a4", "status": "affected", "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "versionType": "git"}, {"lessThan": "6d91479174240f39e9edea250d95fa08c678a207", "status": "affected", "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "versionType": "git"}, {"lessThan": "654fe7505dc6889724d4094fa64f89991afabfc3", "status": "affected", "version": "f1bd904175e8190ce14aedee37e207ab51fe3b30", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["security/apparmor/label.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.13"}, {"lessThan": "4.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: aa_label_alloc use aa_label_free on alloc failure\n\naa_label_alloc() allocates a secid before allocating or taking the label\nproxy. If the later proxy step fails, the error path only freed the label\nmemory, leaking any resources initialized by aa_label_init().\n\nUse aa_label_free() on the failure path so partially initialized labels\nrelease their secid and other label resources before the backing memory is\nfreed."}], "id": "CVE-2026-72459", "lastModified": "2026-08-17T06:19:13.530", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:19.877", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/654fe7505dc6889724d4094fa64f89991afabfc3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6d91479174240f39e9edea250d95fa08c678a207"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7cb69e109610bba500e1ecb870f7988a4717208a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ae02e603c0b39b29f3ce6fe3efe01b286af1a2a4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b14fbacad77d64594228983ec20d61a224f3f491"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b5a9da5d36162d34db0f36abb15420e295176793"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf310b044e85d4de670c94295c5d8e4c5bc5e7bc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cc2192899d502e3321e60cf1e91421e7309d089c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: apparmor: aa_label_alloc use aa_label_free on alloc failure", "id": "2516640", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516640"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\napparmor: aa_label_alloc use aa_label_free on alloc failure\naa_label_alloc() allocates a secid before allocating or taking the label\nproxy. If the later proxy step fails, the error path only freed the label\nmemory, leaking any resources initialized by aa_label_init().\nUse aa_label_free() on the failure path so partially initialized labels\nrelease their secid and other label resources before the backing memory is\nfreed.", "A flaw was found in the AppArmor security module of the Linux kernel. The `aa_label_alloc` function, responsible for allocating security labels, did not properly free all allocated resources in its error handling path. This oversight could lead to a memory leak, potentially impacting system stability or resource availability over time."], "name": "CVE-2026-72459", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72459\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72459\nhttps://lore.kernel.org/linux-cve-announce/2026081532-CVE-2026-72459-cda8@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1bd904175e8190ce14aedee37e207ab51fe3b30,b14fbacad77d64594228983ec20d61a224f3f491)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1bd904175e8190ce14aedee37e207ab51fe3b30,b5a9da5d36162d34db0f36abb15420e295176793)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1bd904175e8190ce14aedee37e207ab51fe3b30,6d91479174240f39e9edea250d95fa08c678a207)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1bd904175e8190ce14aedee37e207ab51fe3b30,654fe7505dc6889724d4094fa64f89991afabfc3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1bd904175e8190ce14aedee37e207ab51fe3b30,cc2192899d502e3321e60cf1e91421e7309d089c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1bd904175e8190ce14aedee37e207ab51fe3b30,bf310b044e85d4de670c94295c5d8e4c5bc5e7bc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1bd904175e8190ce14aedee37e207ab51fe3b30,ae02e603c0b39b29f3ce6fe3efe01b286af1a2a4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1bd904175e8190ce14aedee37e207ab51fe3b30,6d91479174240f39e9edea250d95fa08c678a207)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T18:15:03.781018+00:00", "updated": "2026-08-22T06:45:04.033523+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}