CVE-2026-93245 - Vulnerability Details

- apparmor: policy_int make sure list heads are initialized before fail path

Description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: policy_int make sure list heads are initialized before fail path

If profile create fails before policy_init is complete the list heads
are not properly initialized causing profile_free() sanity checks to
trigger the following splat.

AppArmor WARN aa_policy_destroy: (((!list_empty(&policy->profiles) && (&policy->profiles)->prev != ((void *) 0x122 + (0xdead000000000000UL))))):
WARNING: security/apparmor/lib.c:509 at aa_policy_destroy+0x164/0x1b0 security/apparmor/lib.c:509, CPU#0: syz.0.17/5541
Modules linked in:
CPU: 0 UID: 0 PID: 5541 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:aa_policy_destroy+0x16b/0x1b0 security/apparmor/lib.c:509
Code: 85 ed 7e 4d e8 96 bc 37 fd 5b 41 5c 41 5e 41 5f 5d e9 19 27 4e 07 cc e8 83 bc 37 fd 48 8d 3d 0c f0 d3 0b 48 c7 c6 a4 eb 38 8e <67> 48 0f b9 3a e9 04 ff ff ff e8 66 bc 37 fd 48 8d 3d ff ef d3 0b
RSP: 0018:ffffc9000345eaa0 EFLAGS: 00010293
RAX: ffffffff848f530d RBX: ffff88803f734800 RCX: ffff88801af2a580
RDX: 0000000000000000 RSI: ffffffff8e38eba4 RDI: ffffffff90634320
RBP: 0000000000000000 R08: 0000000000000cc0 R09: 00000000ffffffff
R10: dffffc0000000000 R11: fffffbfff1d95913 R12: dead000000000122
R13: ffff88803f734800 R14: ffff88803f734828 R15: dffffc0000000000
FS: 00007f5f6a1836c0(0000) GS:ffff88808c519000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055d02407b048 CR3: 0000000012aa9000 CR4: 0000000000352ef0
Call Trace:
<TASK>
aa_free_profile+0x9d/0x9f0 security/apparmor/policy.c:334
aa_alloc_profile+0x1e4/0x3e0 security/apparmor/policy.c:416
unpack_profile security/apparmor/policy_unpack.c:1153 [inline]
aa_unpack+0x17db/0x7430 security/apparmor/policy_unpack.c:1748
aa_replace_profiles+0x226/0x2a20 security/apparmor/policy.c:1183
policy_update+0x234/0x4a0 security/apparmor/apparmorfs.c:505
profile_load+0x1cb/0x320 security/apparmor/apparmorfs.c:522
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5f6939e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5f6a183028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5f69625fa0 RCX: 00007f5f6939e0d9
RDX: 0000000000000041 RSI: 0000200000000400 RDI: 0000000000000003
RBP: 00007f5f6a183090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f5f69626038 R14: 00007f5f69625fa0 R15: 00007ffe23725c18

Published: 2026-09-24

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability occurs when AppArmor attempts to create a new profile, but the profile initialization fails before all list heads are set. Subsequent cleanup in aa_policy_destroy dereferences uninitialized pointers, causing a kernel warning and often a crash. This is a local denial‑of‑service flaw; it does not provide code execution or privilege escalation but can bring the system down.

Affected Systems

All Linux kernel installations that use AppArmor and have not applied the patch that ensures list heads are initialized before the fail path. The brand and vendor are generic Linux, so any kernel version prior to the fix is potentially affected.

Risk and Exploitability

The CVSS score and EPSS are not publicly available, and the vulnerability is not listed in the CISA KEV catalog, but the kernel crash signifies a high impact. Because the fault occurs during internal cleanup and requires a specific failure path in AppArmor profile handling, the likelihood of exploitation without privileged access is low. Nonetheless, any local user that can cause AppArmor profile creation failures could trigger a system‑wide denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718`	affected	< 88ba930e7d0586ca2700757249f1e6fc0bbab0fc
`fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718`	affected	< ee017ef9aa2cf20d85d4a20c09ef3db9fb240310
`fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718`	affected	< 62f159fac76468dbbfd977f4f18472d4a01e8d74
`fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718`	affected	< 0664c75afe87a1d7d4f4e1d7eecf50ad829fb6e8
`fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718`	affected	< 4a09a5e6512a3792c78ae8e3ca79cb55a11eed57
`fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718`	affected	< 5449f715f24e86648f8cc8fba8d97ff6b5d04981
`fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718`	affected	< dd52ab1c5436be86f5b8ca118fa8e5d61d63ffed
`fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718`	affected	< 3daad923a8685adb66087e0d819559b7eb6ba975

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718,88ba930e7d0586ca2700757249f1e6fc0bbab0fc)`	affected	code_commit	—
`[fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718,ee017ef9aa2cf20d85d4a20c09ef3db9fb240310)`	affected	code_commit	—
`[fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718,62f159fac76468dbbfd977f4f18472d4a01e8d74)`	affected	code_commit	—
`[fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718,0664c75afe87a1d7d4f4e1d7eecf50ad829fb6e8)`	affected	code_commit	—
`[fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718,4a09a5e6512a3792c78ae8e3ca79cb55a11eed57)`	affected	code_commit	—
`[fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718,5449f715f24e86648f8cc8fba8d97ff6b5d04981)`	affected	code_commit	—
`[fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718,dd52ab1c5436be86f5b8ca118fa8e5d61d63ffed)`	affected	code_commit	—
`[fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718,3daad923a8685adb66087e0d819559b7eb6ba975)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.11`	affected	semver	—
`[0,4.11)`	unaffected	semver	—
`[5.10.270,5.10.*]`	unaffected	generic	—
`[5.15.221,5.15.*]`	unaffected	generic	—
`[6.1.188,6.1.*]`	unaffected	generic	—
`[6.6.157,6.6.*]`	unaffected	generic	—
`[6.12.110,6.12.*]`	unaffected	generic	—
`[6.18.52,6.18.*]`	unaffected	generic	—
`[7.2.6,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that incorporates the AppArmor fix that guarantees list heads are initialized before the failure path.
If an immediate kernel update is not possible, consider disabling AppArmor or preventing profile loads until the patch is applied, as the flaw is limited to AppArmor profile handling.
After applying the update or disabling the component, reboot the system to clear any lingering crash state.

Generated by OpenCVE AI on September 25, 2026 at 07:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00211.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0664c75afe87a1d7d4f4e1d7eecf50ad829fb6e8
https://git.kernel.org/stable/c/3daad923a8685adb66087e0d819559b7eb6ba975
https://git.kernel.org/stable/c/4a09a5e6512a3792c78ae8e3ca79cb55a11eed57
https://git.kernel.org/stable/c/5449f715f24e86648f8cc8fba8d97ff6b5d04981
https://git.kernel.org/stable/c/62f159fac76468dbbfd977f4f18472d4a01e8d74
https://git.kernel.org/stable/c/88ba930e7d0586ca2700757249f1e6fc0bbab0fc
https://git.kernel.org/stable/c/dd52ab1c5436be86f5b8ca118fa8e5d61d63ffed
https://git.kernel.org/stable/c/ee017ef9aa2cf20d85d4a20c09ef3db9fb240310

History

Fri, 25 Sep 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Thu, 24 Sep 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: apparmor: policy_int make sure list heads are initialized before fail path If profile create fails before policy_init is complete the list heads are not properly initialized causing profile_free() sanity checks to trigger the following splat. AppArmor WARN aa_policy_destroy: (((!list_empty(&policy->profiles) && (&policy->profiles)->prev != ((void *) 0x122 + (0xdead000000000000UL))))): WARNING: security/apparmor/lib.c:509 at aa_policy_destroy+0x164/0x1b0 security/apparmor/lib.c:509, CPU#0: syz.0.17/5541 Modules linked in: CPU: 0 UID: 0 PID: 5541 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:aa_policy_destroy+0x16b/0x1b0 security/apparmor/lib.c:509 Code: 85 ed 7e 4d e8 96 bc 37 fd 5b 41 5c 41 5e 41 5f 5d e9 19 27 4e 07 cc e8 83 bc 37 fd 48 8d 3d 0c f0 d3 0b 48 c7 c6 a4 eb 38 8e <67> 48 0f b9 3a e9 04 ff ff ff e8 66 bc 37 fd 48 8d 3d ff ef d3 0b RSP: 0018:ffffc9000345eaa0 EFLAGS: 00010293 RAX: ffffffff848f530d RBX: ffff88803f734800 RCX: ffff88801af2a580 RDX: 0000000000000000 RSI: ffffffff8e38eba4 RDI: ffffffff90634320 RBP: 0000000000000000 R08: 0000000000000cc0 R09: 00000000ffffffff R10: dffffc0000000000 R11: fffffbfff1d95913 R12: dead000000000122 R13: ffff88803f734800 R14: ffff88803f734828 R15: dffffc0000000000 FS: 00007f5f6a1836c0(0000) GS:ffff88808c519000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d02407b048 CR3: 0000000012aa9000 CR4: 0000000000352ef0 Call Trace: <TASK> aa_free_profile+0x9d/0x9f0 security/apparmor/policy.c:334 aa_alloc_profile+0x1e4/0x3e0 security/apparmor/policy.c:416 unpack_profile security/apparmor/policy_unpack.c:1153 [inline] aa_unpack+0x17db/0x7430 security/apparmor/policy_unpack.c:1748 aa_replace_profiles+0x226/0x2a20 security/apparmor/policy.c:1183 policy_update+0x234/0x4a0 security/apparmor/apparmorfs.c:505 profile_load+0x1cb/0x320 security/apparmor/apparmorfs.c:522 vfs_write+0x296/0xba0 fs/read_write.c:685 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5f6939e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5f6a183028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f5f69625fa0 RCX: 00007f5f6939e0d9 RDX: 0000000000000041 RSI: 0000200000000400 RDI: 0000000000000003 RBP: 00007f5f6a183090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f5f69626038 R14: 00007f5f69625fa0 R15: 00007ffe23725c18
Title		apparmor: policy_int make sure list heads are initialized before fail path
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0664c75afe87a1d7d4f4e1d7eecf50ad829fb6e8 https://git.kernel.org/stable/c/3daad923a8685adb66087e0d819559b7eb6ba975 https://git.kernel.org/stable/c/4a09a5e6512a3792c78ae8e3ca79cb55a11eed57 https://git.kernel.org/stable/c/5449f715f24e86648f8cc8fba8d97ff6b5d04981 https://git.kernel.org/stable/c/62f159fac76468dbbfd977f4f18472d4a01e8d74 https://git.kernel.org/stable/c/88ba930e7d0586ca2700757249f1e6fc0bbab0fc https://git.kernel.org/stable/c/dd52ab1c5436be86f5b8ca118fa8e5d61d63ffed https://git.kernel.org/stable/c/ee017ef9aa2cf20d85d4a20c09ef3db9fb240310

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-24T15:51:02.369Z

Updated: 2026-09-24T15:51:02.369Z

Reserved: 2026-09-17T16:02:15.096Z

Link: CVE-2026-93245

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-24T16:17:20.473

Modified: 2026-09-24T16:17:20.473

Link: CVE-2026-93245

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-25T07:45:18Z

Weaknesses

CWE-665
Improper Initialization

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object