CVE-2026-72461

A flaw was found in the AppArmor security module of the Linux kernel. This vulnerability, a reference count leak when updating the sk_ctx, occurs because a reference is unconditionally put by the caller even when it has been transferred. A local attacker could exploit this flaw to cause a denial of service by exhausting system resources.

A flaw of MODERATE severity was found in the AppArmor security module of the Linux kernel, in the update_sk_ctx() function in security/apparmor/af_unix.c. When updating the socket security context (sk_ctx), update_sk_ctx() transfers the plabel (profile label) reference to the socket context, but the caller also unconditionally drops that reference, causing a reference count leak. A local attacker with low privileges able to trigger repeated AppArmor mediation of AF_UNIX sockets could exploit this flaw to exhaust kernel resources, resulting in a denial of service. Red Hat rates this flaw Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because it requires local access and affects only system availability; this differs from the upstream CVE record, which assigns a higher score (7.8, Important) by assuming confidentiality and integrity impacts that this flaw does not cause. The vulnerable code was introduced upstream in Linux kernel version 6.17 and is not present in the kernel versions shipped by Red Hat; consequently, all Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams listed in this flaw are marked not affected because the vulnerable code is not present in them.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.