CVE-2026-72460

A flaw was found in the Linux kernel's AppArmor security module. When changing a security profile, the aa_change_profile() function might attempt to use an invalid security label before properly checking if the label was successfully created. This oversight could allow a local attacker to trigger a system crash by causing the kernel to access an invalid memory location, leading to a Denial of Service (DoS).

A moderate impact flaw was found in the Linux kernel's AppArmor security module. In aa_change_profile(), the replacement label built by fn_label_build_in_scope() was passed to aa_label_is_unconfined_subset() before the existing IS_ERR_OR_NULL() validation, so a failed label build could result in the kernel dereferencing an invalid (NULL or error) label. A local attacker able to trigger this code path could cause a system crash, resulting in a denial of service. Red Hat assessed this flaw as Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because it affects only system availability; the upstream CVE record assigns a higher score (7.1, Important) that includes a confidentiality impact not supported by the technical evidence, which shows only a crash and denial-of-service consequence. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams are currently marked not affected because the vulnerable code is not present in the shipped kernel builds.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.