CVE-2026-72460 - Vulnerability Details

- apparmor: check label build before no_new_privs test

Description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: check label build before no_new_privs test

aa_change_profile() builds a replacement label with
fn_label_build_in_scope() before the no_new_privs subset check. The build
helper can fail and return NULL or an ERR_PTR, but the result was passed
to aa_label_is_unconfined_subset() before the existing IS_ERR_OR_NULL()
check.

Reuse the existing target-label build failure handling immediately after
the build. This preserves the current audit handling while preventing the
subset helper from dereferencing an invalid label.

Published: 2026-08-15

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Based on the description, it is inferred that the flaw in aa_change_profile causes a kernel panic when the function receives a null or error pointer from a failed label build. The code mistakenly passes this pointer to aa_label_is_unconfined_subset, which results in a denial of service by crashing the kernel.

Affected Systems

Based on the vendor list and CPE, it is inferred that any system running the Linux kernel with AppArmor enabled could be affected. The lack of version constraints suggests the issue spans multiple kernel releases until an update containing the patch is applied.

Risk and Exploitability

The likely attack vector is local execution that triggers aa_change_profile, which may be possible with privileged or compromised applications or via crafted profiles. The CVSS score of 7.1 indicates high severity, and the EPSS score of less than 1% suggests a low exploitation probability. The flaw is not listed in the CISA KEV catalog, so active exploitation in the wild has not been documented, but the high CVSS warrants prompt remediation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e00b02bb6ac2a1893227ce8014b649028d6425d2`	affected	< a29f06db44b4c94597ded58f639eed3e21781ac3
`e00b02bb6ac2a1893227ce8014b649028d6425d2`	affected	< cfc224866530a6842b6c2d2d30ef6a9b0e64bb9c
`e00b02bb6ac2a1893227ce8014b649028d6425d2`	affected	< 31cb109db5e6322ed22304fd5c0dedbaa438d6d3
`e00b02bb6ac2a1893227ce8014b649028d6425d2`	affected	< b7c45c05a396a017c49ac7949de240a0dfc0ac4e
`e00b02bb6ac2a1893227ce8014b649028d6425d2`	affected	< d84bb195d208adbf77f012ca2a96e11163f6def1
`e00b02bb6ac2a1893227ce8014b649028d6425d2`	affected	< d82160132345688a09cbaa648cfdd16bb32e8ea2
`e00b02bb6ac2a1893227ce8014b649028d6425d2`	affected	< ec926b2a351eeeb31e6c9aee02e0c32f94b5588f
`e00b02bb6ac2a1893227ce8014b649028d6425d2`	affected	< a58cafd38b46fb1a2220e2fbbcfe291ea75fa147

Linux

affected

Version	Status	Constraints
`4.13`	affected	—
`0`	unaffected	< 4.13
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e00b02bb6ac2a1893227ce8014b649028d6425d2,a29f06db44b4c94597ded58f639eed3e21781ac3)`	affected	code_commit	—
`[e00b02bb6ac2a1893227ce8014b649028d6425d2,cfc224866530a6842b6c2d2d30ef6a9b0e64bb9c)`	affected	code_commit	—
`[e00b02bb6ac2a1893227ce8014b649028d6425d2,31cb109db5e6322ed22304fd5c0dedbaa438d6d3)`	affected	code_commit	—
`[e00b02bb6ac2a1893227ce8014b649028d6425d2,b7c45c05a396a017c49ac7949de240a0dfc0ac4e)`	affected	code_commit	—
`[e00b02bb6ac2a1893227ce8014b649028d6425d2,d84bb195d208adbf77f012ca2a96e11163f6def1)`	affected	code_commit	—
`[e00b02bb6ac2a1893227ce8014b649028d6425d2,d82160132345688a09cbaa648cfdd16bb32e8ea2)`	affected	code_commit	—
`[e00b02bb6ac2a1893227ce8014b649028d6425d2,ec926b2a351eeeb31e6c9aee02e0c32f94b5588f)`	affected	code_commit	—
`[e00b02bb6ac2a1893227ce8014b649028d6425d2,a58cafd38b46fb1a2220e2fbbcfe291ea75fa147)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.13`	affected	generic	—
`[0,4.13)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that contains the CVE-2026-72460 fix.
If an upgrade cannot be performed immediately, temporarily disable or remove AppArmor from the system until the patch is applied.
Monitor system logs for kernel panics and verify that any scripts or applications that invoke aa_change_profile are properly validated to avoid forced failures.

Generated by OpenCVE AI on August 17, 2026 at 16:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00126.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/31cb109db5e6322ed22304fd5c0dedbaa438d6d3
https://git.kernel.org/stable/c/a29f06db44b4c94597ded58f639eed3e21781ac3
https://git.kernel.org/stable/c/a58cafd38b46fb1a2220e2fbbcfe291ea75fa147
https://git.kernel.org/stable/c/b7c45c05a396a017c49ac7949de240a0dfc0ac4e
https://git.kernel.org/stable/c/cfc224866530a6842b6c2d2d30ef6a9b0e64bb9c
https://git.kernel.org/stable/c/d82160132345688a09cbaa648cfdd16bb32e8ea2
https://git.kernel.org/stable/c/d84bb195d208adbf77f012ca2a96e11163f6def1
https://git.kernel.org/stable/c/ec926b2a351eeeb31e6c9aee02e0c32f94b5588f
https://lore.kernel.org/linux-cve-announce/2026081533-CVE-2026-72460-82bd@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72460
https://www.cve.org/CVERecord?id=CVE-2026-72460

History

Wed, 19 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081533-CVE-2026-72460-82bd@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72460 https://www.cve.org/CVERecord?id=CVE-2026-72460
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Mon, 17 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}`

Sat, 15 Aug 2026 12:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before no_new_privs test aa_change_profile() builds a replacement label with fn_label_build_in_scope() before the no_new_privs subset check. The build helper can fail and return NULL or an ERR_PTR, but the result was passed to aa_label_is_unconfined_subset() before the existing IS_ERR_OR_NULL() check. Reuse the existing target-label build failure handling immediately after the build. This preserves the current audit handling while preventing the subset helper from dereferencing an invalid label.
Title		apparmor: check label build before no_new_privs test
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/31cb109db5e6322ed22304fd5c0dedbaa438d6d3 https://git.kernel.org/stable/c/a29f06db44b4c94597ded58f639eed3e21781ac3 https://git.kernel.org/stable/c/a58cafd38b46fb1a2220e2fbbcfe291ea75fa147 https://git.kernel.org/stable/c/b7c45c05a396a017c49ac7949de240a0dfc0ac4e https://git.kernel.org/stable/c/cfc224866530a6842b6c2d2d30ef6a9b0e64bb9c https://git.kernel.org/stable/c/d82160132345688a09cbaa648cfdd16bb32e8ea2 https://git.kernel.org/stable/c/d84bb195d208adbf77f012ca2a96e11163f6def1 https://git.kernel.org/stable/c/ec926b2a351eeeb31e6c9aee02e0c32f94b5588f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:57:05.404Z

Updated: 2026-08-17T05:44:26.306Z

Reserved: 2026-08-09T03:40:39.932Z

Link: CVE-2026-72460

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:19.993

Modified: 2026-08-17T06:19:13.667

Link: CVE-2026-72460

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72460 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-17T17:00:05Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object