CVE-2026-72455

A flaw was found in the AppArmor security module of the Linux kernel. A bug in the path_name() function, related to handling aa_null files, may cause an uninitialized pointer to be passed to aa_audit_file(). This can lead to a kernel page fault, resulting in a system crash and a Denial of Service (DoS) for a local attacker.

This vulnerability is rated as Moderate impact because an authenticated local user can trigger an unhandled kernel fault, resulting in a denial of service without compromising system confidentiality or integrity. In standard Red Hat deployments, SELinux is utilized as the primary mandatory access control framework rather than AppArmor. Furthermore, the vulnerable implementation is not present in supported Red Hat Enterprise Linux kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.