CVE-2026-89762: apparmor: fix cred UAF caused by begin_current_label_crit_section()
apparmor: fix cred UAF caused by begincurrentlabelcritsection()
Affected Software
Event History
Frequently Asked Questions
Which kernel activity is most likely to reach the affected logic?
The affected function is called from many LSM hooks, particularly hooks associated with VFS and socket operations. Systems using AppArmor may encounter it when a current credential label is marked stale and needs replacement.
What condition leads to the unsafe credential handling?
The issue arises when the current credentials reference an AppArmor label marked FLAG_STALE. The function then attempts to replace the current credentials with credentials using an updated label, which can invalidate previously retained pointers to struct cred.
Why do overridden credentials matter?
The replacement path checks whether current_cred() differs from current_real_cred() and bails out when credentials are overridden. The vulnerability description identifies this handling as another case where the replacement logic behaves incorrectly.