Linux kernel AppArmor vulnerabilities

A deadlock exists in the Linux kernel AppArmor subsystem when change_hat is used in complain mode and the target hat does not exist, causing a new learning profile to be created. change_hat() holds a lock while searching the hat list, and creating the new learning profile tries to acquire the same lock, resulting in a hang. The issue affects kernels 6.18.44 and 7.2-rc7 (and 7.0.0 on Ubuntu 26.04 LTS), and is fixed in e.g. 6.12.95 with Debian patches.

A use-after-free (UAF) vulnerability in the Linux kernel's AppArmor module, related to begin_current_label_crit_section(), has been fixed. The function could directly replace credential pointers (struct cred) during an LSM hook invocation, causing task->cred and task->real_cred to become inconsistent and leading to freed credential memory still being referenced by other tasks.

A fix has been applied in the Linux kernel for an out-of-bounds write in the AppArmor aa_vec_unique() function. When all label components are distinct, the NULL terminator is written to vec[n], but vec_setup() does not reserve space for this extra entry, causing a write one element past the end of the local array or allocation. The vulnerability can be triggered by an unprivileged task writing to /proc/self/attr/apparmor/current or via lsm_set_self_attr(2), and also through the securityfs .access file which is mode 0666.

A vulnerability has been identified in the Linux kernel within AppArmor, leading to a NULL pointer dereference in the __unix_needs_revalidation function. This issue occurs when receiving file descriptors via SCM_RIGHTS, where both the socket and sk pointers may be NULL.