CVE-2026-72459
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In the Linux kernel's AppArmor module, a resource leak exists in aa_label_alloc(). The function allocates a secid before allocating or taking the label proxy. If the later proxy step fails, the error path only frees the label memory, leaking resources initialized by aa_label_init().
Risk Assessment
Resource leak can lead to memory exhaustion and system instability.
Recommendation
Apply a Linux kernel update containing the fix that uses aa_label_free() on the failure path to release secid and other label resources.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: apparmor: aa_label_alloc use aa_label_free on alloc failure aa_label_alloc() allocates a secid before allocating or taking the label proxy. If the later proxy step fails, the error path only freed the label memory, leaking any resources initialized by aa_label_init(). Use aa_label_free() on the failure path so partially initialized labels release their secid and other label resources before the backing memory is freed.