What is the CVSS score of CVE-2026-72461?

CVE-2026-72461 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72461?

A privilege escalation vulnerability in the Linux kernel AppArmor module threatens systems where local users could gain root access through a reference count management flaw.. A patch is available.

How to fix or mitigate CVE-2026-72461?

Within 24 hours, audit systems to identify those running affected Linux kernel versions (pre-6.18.40, pre-7.1.5, or pre-7.2-rc1) with AppArmor enabled, prioritizing production environments. Within 7 days, deploy vendor-released kernel patches by upgrading to Linux kernel 6.18.40, 7.1.5, 7.2-rc1 or later depending on your supported branch. Within 30 days, confirm patch deployment across all production systems, validate AppArmor security policies remain functional, and review system logs for suspicious local access patterns that may indicate exploitation attempts.

Linux Kernel CVE-2026-72461

EUVD-2026-59360 HIGH

2026-08-15 Linux

GHSA-437g-9c5w-262m

Information Disclosure Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local vector confirmed; AC raised to H because converting a refcount underflow to reliable privilege escalation requires heap manipulation beyond the base trigger.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:34 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:57 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 05:57 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix refcount leak when updating the sk_ctx

Currently update_sk_ctx() transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the reference based on whether it was transferred but for now just fix the bug by getting a reference.

AnalysisAI

Reference count leak in the Linux kernel AppArmor security module allows a local low-privileged user to trigger use-after-free conditions via a bug in update_sk_ctx() socket context management, potentially achieving privilege escalation with high confidentiality, integrity, and availability impact. The fix, backported across stable branches (6.18.40, 7.1.5, 7.2-rc1), corrects the unconditional plabel reference put in the caller by adding a compensating reference acquisition. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.

Technical ContextAI

The vulnerability resides in the AppArmor Linux Security Module (LSM), specifically the update_sk_ctx() function responsible for updating security contexts on socket objects (sk_ctx). AppArmor uses reference-counted label objects (plabel) to enforce mandatory access control policies on network sockets. The bug is a classic refcount imbalance: update_sk_ctx() transfers ownership of the plabel reference to the new socket context but the calling function also unconditionally calls a reference-release (put) on it, resulting in one extra decrement. Depending on kernel memory allocator behaviour and timing, this double-put can produce a use-after-free condition on the label object. CPE cpe:2.3:a:linux:linux confirms all Linux kernel versions between commit 88fec3526e84123997ecebd6bb6778eb4ce779b7 and the respective fix commits across multiple stable series are affected. No formal CWE is assigned, but this is consistent with CWE-911 (Improper Update of Reference Count) and CWE-416 (Use After Free).

RemediationAI

Upgrade to a fixed kernel version: Linux 6.18.40, 7.1.5, or any mainline release at or after 7.2-rc1. The upstream fix commits are available at https://git.kernel.org/stable/c/b8642f1478982a97ca2eb59f70f631a9de42ae11, https://git.kernel.org/stable/c/045dbe89ac31709abd73390d0805d52fece7ef39, and https://git.kernel.org/stable/c/6d25e7b47616cb2db43351210929c8f19dc305a3. Distribution-packaged kernel updates for Debian, Ubuntu, and other AppArmor-default distros should be monitored via their respective security advisories. For systems where immediate patching is not possible, a compensating control is to disable AppArmor enforcement on network socket contexts (aa-disable or removing AppArmor profile for the relevant service), though this trade-off eliminates the security boundary AppArmor provides for those services and is not recommended for production workloads. Restricting local shell access to untrusted users reduces the practical attack surface until patching is completed.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72461 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72461

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code