CVE-2026-72459

apparmor: aa_label_alloc use aa_label_free on alloc failure

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: aa_label_alloc use aa_label_free on alloc failure

aa_label_alloc() allocates a secid before allocating or taking the label proxy. If the later proxy step fails, the error path only freed the label memory, leaking any resources initialized by aa_label_init().

Use aa_label_free() on the failure path so partially initialized labels release their secid and other label resources before the backing memory is freed.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f1bd904175e8190ce14aedee37e207ab51fe3b30 to before b14fbacad77d64594228983ec20d61a224f3f491Affected f1bd904175e8190ce14aedee37e207ab51fe3b30 to before b5a9da5d36162d34db0f36abb15420e295176793Affected f1bd904175e8190ce14aedee37e207ab51fe3b30 to before 7cb69e109610bba500e1ecb870f7988a4717208aAffected f1bd904175e8190ce14aedee37e207ab51fe3b30 to before cc2192899d502e3321e60cf1e91421e7309d089cAffected f1bd904175e8190ce14aedee37e207ab51fe3b30 to before bf310b044e85d4de670c94295c5d8e4c5bc5e7bcAffected f1bd904175e8190ce14aedee37e207ab51fe3b30 to before ae02e603c0b39b29f3ce6fe3efe01b286af1a2a4Affected f1bd904175e8190ce14aedee37e207ab51fe3b30 to before 6d91479174240f39e9edea250d95fa08c678a207Affected f1bd904175e8190ce14aedee37e207ab51fe3b30 to before 654fe7505dc6889724d4094fa64f89991afabfc3Affected
LinuxLinux	4.13Affected before 4.13Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

f1bd904175e8190ce14aedee37e207ab51fe3b30 to before b14fbacad77d64594228983ec20d61a224f3f491Affected
f1bd904175e8190ce14aedee37e207ab51fe3b30 to before b5a9da5d36162d34db0f36abb15420e295176793Affected
f1bd904175e8190ce14aedee37e207ab51fe3b30 to before 7cb69e109610bba500e1ecb870f7988a4717208aAffected
f1bd904175e8190ce14aedee37e207ab51fe3b30 to before cc2192899d502e3321e60cf1e91421e7309d089cAffected
f1bd904175e8190ce14aedee37e207ab51fe3b30 to before bf310b044e85d4de670c94295c5d8e4c5bc5e7bcAffected
f1bd904175e8190ce14aedee37e207ab51fe3b30 to before ae02e603c0b39b29f3ce6fe3efe01b286af1a2a4Affected
f1bd904175e8190ce14aedee37e207ab51fe3b30 to before 6d91479174240f39e9edea250d95fa08c678a207Affected
f1bd904175e8190ce14aedee37e207ab51fe3b30 to before 654fe7505dc6889724d4094fa64f89991afabfc3Affected

LinuxLinux

4.13Affected
before 4.13Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.