CVE-2026-72455 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix uninitialised pointer passed to audit_log_untrustedstring()
Commit 4a134723f9f1 ("apparmor: move check for aa_null file to cover all cases") intrdouced a small bug, where path_name() may pass a potentially uninitialized *name to aa_audit_file() if the path->dentry had been replaced with aa_null.dentry earlier on. This can lead to page fault like one observed on 7.0.2 openSUSE Tumbleweed kernel:
[51692.242756] [ T24690] BUG: unable to handle page fault for address: 0000000f00000003
[51692.242762] [ T24690] #PF: supervisor read access in kernel mode
[51692.242763] [ T24690] #PF: error_code(0x0000) - not-present page
[51692.242765] [ T24690] PGD 0 P4D 0
[51692.242768] [ T24690] Oops: Oops: 0000 [#1] SMP NOPTI
[51692.242772] [ T24690] CPU: 3 UID: 1020 PID: 24690 Comm: snap-confine Tainted: G O 7.0.2-1-default #1 PREEMPT(full) openSUSE Tumbleweed ab90b4c9940707f9cafa19bdad80b2cec52dbe51
[51692.242775] [ T24690] Tainted: [O]=OOT_MODULE
[51692.242777] [ T24690] Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP05, BIOS 03.18 01/08/2026
[51692.242778] [ T24690] RIP: 0010:strlen+0x4/0x30
[51692.242783] [ T24690] Code: f7 75 ec 31 c0 e9 17 9f 00 ff 48 89 f8 e9 0f 9f 00 ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 18 48 89 f8 0f 1f 40 00 48 83 c0 01 80 38 00 75 f7 48
[51692.242785] [ T24690] RSP: 0018:ffffd015eb1e3608 EFLAGS: 00010282
[51692.242787] [ T24690] RAX: 0000000000000000 RBX: ffff89796198a360 RCX: 0000000000000000
[51692.242788] [ T24690] RDX: 00000000000000d1 RSI: 0000000f00000003 RDI: 0000000f00000003
[51692.242790] [ T24690] RBP: ffffffffb7ede090 R08: 00000000000005f5 R09: 0000000000000000
[51692.242791] [ T24690] R10: 0000000000000000 R11: 0000000000000000 R12: ffffd015eb1e3700
[51692.242792] [ T24690] R13: ffff8977a22bc380 R14: ffffffffb7ec5190 R15: ffff8977a0c8aa80
[51692.242794] [ T24690] FS: 0000000000000000(0000) GS:ffff897f640d8000(0000) knlGS:0000000000000000
[51692.242796] [ T24690] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[51692.242797] [ T24690] CR2: 0000000f00000003 CR3: 00000006ad15f000 CR4: 0000000000f50ef0
[51692.242799] [ T24690] PKRU: 55555554
[51692.242800] [ T24690] Call Trace:
[51692.242802] [ T24690] <TASK>
[51692.242804] [ T24690] audit_log_untrustedstring+0x1d/0x40
[51692.242811] [ T24690] common_lsm_audit+0x71/0x1d0
[51692.242816] [ T24690] aa_audit+0x5a/0x170
[51692.242819] [ T24690] aa_audit_file+0x18a/0x1b0
[51692.242825] [ T24690] path_name+0xd2/0x100
[51692.242829] [ T24690] profile_path_perm.part.0+0x58/0xb0
[51692.242832] [ T24690] aa_path_perm+0xef/0x150
[51692.242837] [ T24690] apparmor_file_open+0x153/0x2e0
[51692.242840] [ T24690] security_file_open+0x46/0xd0
[51692.242844] [ T24690] do_dentry_open+0xe9/0x4d0
[51692.242848] [ T24690] vfs_open+0x30/0x100
While here, initialise variables which are passed down to path_name().
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides within the Linux kernel's AppArmor security module and represents a classic case of uninitialized pointer usage leading to kernel panic. The issue stems from commit 4a134723f9f1 which introduced a logic flaw in the path_name() function where a pointer may be passed to aa_audit_file() without proper initialization. The specific problem occurs when path->dentry has been replaced with aa_null.dentry earlier in the execution flow, creating a scenario where the name variable remains uninitialized. This uninitialized pointer then gets passed through multiple function calls including audit_log_untrustedstring(), ultimately leading to a page fault when the kernel attempts to dereference the invalid memory address 0x0000000f00000003. The error manifests as a supervisor read access violation in kernel mode, indicating that user-space code is attempting to access kernel memory with invalid permissions.
The technical root cause aligns with CWE-457: Use of Uninitialized Variable and represents a memory safety vulnerability that can lead to system crashes and potential privilege escalation. When the kernel attempts to process the uninitialized pointer through strlen() in the audit logging chain, it encounters corrupted data at an address that should contain valid string content but instead contains garbage values from memory. This flaw operates at the kernel level where memory corruption directly impacts system stability and security posture, as demonstrated by the crash occurring during snap-confine execution which is a common AppArmor enforcement scenario.
The operational impact of this vulnerability extends beyond simple system crashes to potentially compromise the integrity of the security framework itself. Since AppArmor is designed to enforce mandatory access controls, a kernel panic caused by uninitialized pointer dereference could allow malicious actors to bypass security policies or cause denial of service attacks that affect legitimate system operations. The vulnerability affects systems running affected kernel versions where AppArmor is enabled, particularly impacting containerized environments and applications that rely on AppArmor for security enforcement such as snap packages in openSUSE Tumbleweed distributions.
Mitigation strategies should focus on immediate kernel updates to address the uninitialized pointer issue through proper variable initialization before passing parameters to path_name() function. System administrators should prioritize applying the patched kernel version that resolves commit 4a134723f9f1 and ensures all variables are properly initialized prior to security audit operations. Additionally, monitoring for kernel oops messages and page fault errors related to AppArmor components can help detect potential exploitation attempts. Organizations should also consider implementing runtime protections such as kernel lockdown modes and enhanced logging of AppArmor audit events to detect anomalous behavior that may indicate exploitation attempts. The fix aligns with ATT&CK technique T1562.001: Impair Defenses - Disable or Modify Tools, as it addresses a kernel-level vulnerability that could be leveraged to undermine security controls, though the specific mitigation focuses on preventing the immediate crash rather than providing active defense against exploitation attempts.