CVE-2026-72456

A flaw was found in AppArmor within the Linux kernel. When the get_current_exe_path() function encounters a path resolution failure, it fails to properly release file and path references. This resource leak could be exploited by a local attacker, potentially leading to a Denial of Service (DoS) by exhausting system resources.

A moderate severity flaw was found in the AppArmor implementation in the Linux kernel. The get_current_exe_path() function in security/apparmor/task.c takes both an exe file reference and a path reference before resolving the path name; when aa_path_name() failed, it returned immediately and leaked both references instead of releasing them via fput() and path_put(). A local attacker able to trigger the path resolution failure could exploit this reference leak repeatedly to exhaust kernel resources, resulting in a denial of service. Red Hat rates this flaw as moderate impact, with a CVSS 3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The vulnerable code was introduced in the upstream Linux kernel 7.0 release and is not present in the kernels shipped in any supported Red Hat Enterprise Linux or Red Hat In-Vehicle OS stream, so all Red Hat products tracked for this flaw are not affected and Red Hat customers are not exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.