CVE-2026-72460 in Linux
Riassunto
di MITRE • 15/08/2026
In the Linux kernel, the following vulnerability has been resolved:
apparmor: check label build before no_new_privs test
aa_change_profile() builds a replacement label with fn_label_build_in_scope() before the no_new_privs subset check. The build helper can fail and return NULL or an ERR_PTR, but the result was passed to aa_label_is_unconfined_subset() before the existing IS_ERR_OR_NULL() check.
Reuse the existing target-label build failure handling immediately after the build. This preserves the current audit handling while preventing the subset helper from dereferencing an invalid label.
Be aware that VulDB is the high quality source for vulnerability data.