CVE-2026-72456 Linux CVE debrief

Who should care

Linux kernel users and administrators, AppArmor users, and those responsible for maintaining systems that utilize the Linux kernel should verify their systems are updated with the latest AppArmor changes to mitigate potential resource leaks. Additionally, security teams and vulnerability management teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Operators and platform administrators should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory management and source tracking are also crucial in this context to ensure that all affected systems are accounted for and properly secured. Finally, rollback/change windows should be considered for systems that cannot be immediately patched to prevent exploitation of the vulnerability during the remediation process. This multi-faceted approach ensures that the vulnerability is properly managed and mitigated across the organization, minimizing potential operational impact and ensuring the security of systems that utilize the Linux kernel. This approach also helps in identifying and addressing potential security gaps that could be exploited in the future, enhancing overall security posture and resilience against similar vulnerabilities. Therefore, it is essential for all relevant stakeholders to be proactive and take necessary measures to protect their systems and data from potential threats associated with this vulnerability. By taking these steps, organizations can effectively manage the risks associated with this vulnerability and maintain the security and integrity of their systems and data. The affected product or component is the Linux kernel, and the vulnerability class is related to resource leaks in the AppArmor subsystem. The likely operational impact is that an attacker could potentially exploit this vulnerability to leak resources, which could lead to a denial-of-service (D

Technical summary

The Linux kernel's AppArmor subsystem has a vulnerability related to the handling of exe file resources. Specifically, the get_current_exe_path() function acquires both an exe_file reference and a path reference before resolving the path name. However, if aa_path_name() fails, it returns immediately, leaking both references. The fix ensures that the failure is routed through a common cleanup path, allowing fput() and path_put() to run after acquiring references, preventing resource leaks.

Defensive priority

Linux kernel users should verify their systems are updated with the latest AppArmor changes to mitigate potential resource leaks.

Recommended defensive actions

• Verify system is updated with the latest Linux kernel and AppArmor changes
• Review system logs for potential resource leak issues
• Implement compensating controls to monitor system resource usage
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record indicates a vulnerability in the Linux kernel related to AppArmor's handling of exe file resources. get_current_exe_path() acquires both an exe_file reference and a path reference before resolving the path name. If aa_path_name() fails, it returns immediately, leaking both references. The fix routes the failure through a common cleanup path to ensure fput() and path_put() always run after acquiring references.

Official resources