Linux Kernel CVE-2026-72459

AppArmor (Application Armor) is a Linux Security Module (LSM) that enforces per-process access control policies. The function aa_label_alloc() in the AppArmor subsystem performs a two-step allocation: first it reserves a security identifier (secid) via the kernel's LSM ID allocation infrastructure, then it acquires or creates a label proxy structure. The defect is on the error path: if proxy acquisition fails, the code freed only the raw label backing memory without calling aa_label_free(), which is the proper cleanup function responsible for releasing the secid and all resources initialized by aa_label_init(). This constitutes an improper error-path resource release - functionally similar to CWE-772 (Missing Release of Resource after Effective Lifetime) - in a security-critical kernel subsystem. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* starting from kernel 4.13 (when this AppArmor label allocation path was introduced) through the respective stable-branch fix commits.