CVE-2026-72459

A flaw was found in the AppArmor security module of the Linux kernel. The aa_label_alloc function, responsible for allocating security labels, did not properly free all allocated resources in its error handling path. This oversight could lead to a memory leak, potentially impacting system stability or resource availability over time.

A MODERATE severity memory leak flaw was found in the AppArmor security module of the Linux kernel. The aa_label_alloc() function allocates a secid and initializes label resources before allocating or taking the label proxy; when that later step failed, the error path freed only the label's backing memory, leaking the secid and other resources initialized by aa_label_init(). The flaw can only be triggered locally with low privileges, and successful exploitation would leak kernel memory on the error path, potentially impacting system stability and resource availability over time; there is no impact on confidentiality or integrity. Red Hat's severity of MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) differs from the upstream CVE.org severity of IMPORTANT (7.8) because the CVE.org vector includes high confidentiality and integrity impacts, while the technical evidence shows this issue is limited to a resource leak affecting only availability. All Red Hat products in scope are not affected because the vulnerable code is not present in the shipped versions; this covers the kernel and kernel-rt components of Red Hat Enterprise Linux 6, 7, 8, 9, and 10 and the kernel components of Red Hat In-Vehicle OS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.