What is the CVSS score of CVE-2026-72462?

CVE-2026-72462 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72462?

CVE-2026-72462 in the Linux kernel AppArmor subsystem enables local privilege escalation to full system compromise on affected systems using peer path-based security rules.

How to fix or mitigate CVE-2026-72462?

Within 24 hours, inventory Linux systems with AppArmor enabled and identify those using peer path-based rules to establish exposure scope. Within 7 days, implement monitoring for local privilege escalation attempts and restrict local user access on critical systems where possible. Within 30 days, monitor vendor kernel security advisories for patch availability, evaluate whether disabling non-critical peer path-based AppArmor rules is feasible, and consider alternative mandatory access control frameworks (SELinux, SMACK) as supplementary protection on high-value infrastructure.

Linux Kernel CVE-2026-72462

EUVD-2026-59361 HIGH

2026-08-15 Linux

GHSA-6qw2-4mf7-jw7c

Information Disclosure Linux Red Hat Suse

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Race condition exploitation requires precise kernel-level timing control, warranting AC:H over NVD's AC:L; S:C retained for kernel-scope impact; PR:L confirmed by local unprivileged access requirement.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:35 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

CVE Published

Aug 15, 2026 - 05:57 cve.org

HIGH 8.8

CVE Published

Aug 15, 2026 - 05:57 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix race in unix socket mediation when peer_path is used

The holding a reference to the peer_sk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows for a race with unix_release_sock(). Fix this by taking the state lock and getting a reference to the path under lock.

Ideally for connected sockets we would cache this information so we don't have to take the lock here. But for now just fix the race.

AnalysisAI

Race condition in the Linux kernel AppArmor unix socket mediation subsystem exposes systems with peer path-based AppArmor rules to a use-after-free scenario, enabling a local low-privileged user to potentially escalate privileges and achieve full compromise of confidentiality, integrity, and availability. The flaw involves accessing a peer unix socket's path (peer_path) outside the kernel socket state lock, creating a window for concurrent execution of unix_release_sock() to free the referenced path while AppArmor reads it. No public exploit code exists and the EPSS score sits at a low 0.17% (7th percentile), but the NVD-assigned CVSS scope change (S:C) reflects that successful exploitation could reach kernel-level components beyond the attacking process.

Technical ContextAI

The vulnerability resides in the Linux kernel's AppArmor mandatory access control (MAC) subsystem, specifically in the unix domain socket (AF_UNIX) mediation path used when AppArmor policies employ peer path matching. When evaluating a unix socket connection, AppArmor acquires a reference to the peer socket object (peer_sk) but dereferences the peer's path (peer_path) outside the socket state lock. This creates a classic TOCTOU (Time-of-Check to Time-of-Use) race: the concurrent kernel function unix_release_sock() can release the socket and invalidate the path structure while AppArmor is reading it, resulting in a use-after-free read of kernel memory. No CWE is formally assigned by NVD, but the root cause maps to CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) and CWE-416 (Use After Free). The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the full Linux kernel tree. The fix, confirmed by upstream commits, takes the socket state lock before accessing the path reference.

RemediationAI

The primary remediation is to upgrade to a patched Linux kernel: version 6.18.40 for the 6.x stable branch, 7.1.5 for the 7.1 stable branch, or 7.2-rc1 for the development branch, as confirmed by upstream commits at git.kernel.org/stable/c/d8ea44f6090c087fe255d9512fb808574b4d88e8, git.kernel.org/stable/c/d680472db98823d90fc91362910901e468269318, and git.kernel.org/stable/c/b1aea2c1960771a276d7e68c7424168eccd0c3da. Major distributions such as Ubuntu, Debian, SUSE, and Red Hat typically backport these fixes to their kernel packages; consult your distribution's security errata for package-level updates. For systems where immediate kernel patching is not feasible, a targeted workaround is to remove or disable AppArmor profiles that use unix socket peer path matching rules - this eliminates the vulnerable code path at the cost of reduced AppArmor policy enforcement granularity for unix socket IPC, which may be acceptable if those rules are not critical to your security posture. Additionally, restricting local user access on sensitive systems reduces the attack surface, as PR:L access is a prerequisite.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72462 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72462

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code