Linux Kernel AppArmor Security Fixes

Use-after-free in Linux kernel AppArmor allows local authenticated users to achieve high confidentiality, integrity, and availability impact through a race condition between inode eviction and filesystem callbacks. The vulnerability stems from premature reference release of i_private data before inode cleanup completes. Patch available from kernel.org stable branches affecting Linux 4.13+ with Ubuntu marking priority=high across 729 releases. EPSS score of 0.02% suggests limited observed exploitation attempts despite widespread kernel deployment.

Double-free memory corruption in Linux kernel's AppArmor profile replacement allows local authenticated users to trigger kernel crashes or potentially execute arbitrary code with kernel privileges. The flaw affects Linux kernel versions from 5.5 onwards, with vendor patches available across multiple stable branches (6.6.130, 6.12.77, 6.18.18, 6.19.8, 7.0-rc4). EPSS exploitation probability is low (0.02%, 5th percentile) and no public exploit identified at time of analysis, though Ubuntu rates this medium priority with patches deployed across 729 releases.

Use-after-free in Linux kernel AppArmor allows local authenticated attackers to achieve high-impact code execution, privilege escalation, or denial of service via race condition on rawdata inode dereference. Affects kernel 4.13+ including current LTS branches. Patches available for 6.6.130, 6.12.77, 6.18.18, 6.19.8, and 7.0-rc4. EPSS score is low (0.02%) with no public exploit identified at time of analysis, but Ubuntu rated this priority=high affecting 729 releases.

Out-of-bounds read and write in Linux kernel AppArmor DFA verification allows local authenticated users to cause memory corruption and potential privilege escalation. Affects Linux kernel 4.17+ through 6.12.x, actively patched in stable branches 6.6.130, 6.12.77, 6.18.18, and 6.19.8. The vulnerability occurs during AppArmor policy loading when malformed DFA structures bypass bounds checking in verify_dfa(). EPSS score of 0.02% suggests low exploitation probability in the wild; no public exploit code or CISA KEV listing identified. Ubuntu rates this medium priority with patches released via USN-8152-1.

Out-of-bounds memory read in Linux kernel AppArmor DFA matching affects kernel versions since 4.17 due to macro side-effect bug. The match_char() macro evaluates its character parameter multiple times when called with *str++, causing the pointer to advance past buffer boundaries during differential encoding chain traversal. Ubuntu has released patches (USN-8152-1) with fixes available in kernels 6.6.130, 6.12.77, 6.18.18, 6.19.8, and 7.0-rc4. EPSS score of 0.02% (5th percentile) indicates very low exploitation probability, and no public exploit or CISA KEV listing exists. CVSS 7.8 reflects local high-privilege impact, but real-world risk is limited to authenticated local users who can trigger AppArmor path permission checks.

Stack exhaustion in AppArmor profile removal allows local denial of service by crafting deeply nested profiles that trigger recursive kernel stack consumption. The Linux kernel's AppArmor security module can be crashed by a local user with permission to load profiles via the apparmor_parser tool and trigger removal through sysfs, causing kernel stack overflow. The fix replaces recursive profile removal with an iterative approach to prevent stack exhaustion.

Memory leak in Linux kernel AppArmor module verify_header function causes namespace string allocation leaks during multiple profile unpacking and breaks namespace consistency checking. The vulnerable code incorrectly resets the namespace pointer to NULL on every function call, discarding previously allocated namespace strings and preventing proper namespace comparison across profile iterations. This affects Linux kernel versions with the vulnerable AppArmor implementation prior to upstream fixes applied across stable branches.

Linux kernel AppArmor policy namespace implementation allows arbitrary nesting and creation of policy namespaces without enforcing depth limits, enabling local attackers to exhaust system resources through unbounded namespace proliferation. The vulnerability affects AppArmor in the Linux kernel across multiple stable branches. This is a denial-of-service vulnerability requiring local access, with fixes available across stable kernel versions.

AppArmor differential encoding verification in the Linux kernel contains logic errors that permit infinite loops to be created through abuse of the verification chain mechanism. Two distinct bugs in the verification routine-conflation of checked states with currently-checked states, and incorrect loop iterator comparison-allow malformed differential encoding chains to bypass security checks. This enables potential information disclosure or policy circumvention on systems relying on AppArmor mandatory access control. The vulnerability affects Linux kernel versions prior to fixes applied across multiple stable branches via kernel commits.