Linux Kernel CVE-2026-72460

AppArmor is a Linux Security Module (LSM) that enforces mandatory access control via profile-based security labels. The aa_change_profile() function enables runtime profile transitions and relies on fn_label_build_in_scope() to construct a replacement security label for the target profile. This build helper can legitimately fail under resource pressure or policy inconsistency, returning NULL on allocation failure or an ERR_PTR on error. The vulnerable code path passed this potentially invalid result directly to aa_label_is_unconfined_subset() - which dereferences the label pointer - before the pre-existing IS_ERR_OR_NULL() check could intercept it. The fix reorders control flow so that build failures are caught and routed through the existing audit and error-handling path immediately after the build call, preventing the unsafe dereference. The root cause aligns with CWE-476 (NULL Pointer Dereference) and CWE-20 (Improper Input Validation), though NVD did not assign a CWE for this entry. CPE data identifies cpe:2.3:a:linux:linux as the affected product across all tracked branches.