apparmor: fix deadlock in complain-mode change_hat
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix deadlock in complain-mode change_hat The use of change_hat when in complain mode can cause a deadlock when the hat doesn't exist and a new learning profile is created for the missing profile. This is because change_hat() has taken the lock to search the hat list and creating the new learning profile needs to take the lock to add it to the list. From the bug report: Originally found in 7.0.0 in LTS ubuntu 26.04 with pam_apparmor + su in complain mode set to change hats. Then verified in newest available vanilla kernel I've compiled to see if still present: 7.2-rc7 vanilla -> affected checked also some other kernels: 6.18.44 vanilla -> affected 6.12.95 with debian patches -> unaffected On systems without bug (for example 6.12.95 debian) it just prints: aa_change_hat rc=0 On systems with bug, the executable always hangs, prints nothing and becomes unkillable. (And once stuck this way, it will cause any further hat changes to also cause the changing process to get stuck) Then in syslog you can find hint about cause: kernel: INFO: task hat:3409 blocked for more than 483 seconds. kernel: Not tainted 7.2.0-rc7 #1 kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kernel: task:hat state:D stack:0 pid:3409 tgid:3409 ppid:2605 task_flags:0x400000 flags:0x00080800 kernel: Call Trace: kernel: kernel: __schedule+0x48f/0xfe0 kernel: schedule+0x27/0xa0 kernel: schedule_preempt_di
CVE-2026-90179
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-90179
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5acb878db41328dae4d3249bc87b9ee4f290a663",
"lessThan": "5f1fedccf3f7add5e2a1205ac4938fa3893c5874",
"versionType": "git"
},
{
"status": "affected",
"version": "6446dbe02f4a3592bf062b4d12105927993086af",
"lessThan": "91fce09d89b2d397996226216820f0e8b8149e22",
"versionType": "git"
},
{
"status": "affected",
"version": "b427061ca498309bf581bb6f8df4ffcfe4c772cd",
"lessThan": "00cce5e457cb690a3b3b3d334e76e71049ec8ae5",
"versionType": "git"
},
{
"status": "affected",
"version": "32e92764d6f8d251c1bca62be33793287b453a81",
"lessThan": "072fb5aeec2eac7d445bf28c7119a1d6f6a2e333",
"versionType": "git"
},
{
"status": "affected",
"version": "32e92764d6f8d251c1bca62be33793287b453a81",
"lessThan": "4ec11f14d1d6fdda787d991b142537be7841d395",
"versionType": "git"
},
{
"status": "affected",
"version": "862ae1fcc78aea9acab2ac87cccf6431f4682b8e",
"versionType": "git"
},
{
"status": "affected",
"version": "65f95c1e7ce70bf339504e22473879e02026cfc4",
"versionType": "git"
},
{
"status": "affected",
"version": "9735e300a1c9259bfe4dc5ecdba472bb25574e8a",
"versionType": "git"
},
{
"status": "affected",
"version": "67ee65ec1a3eebdde76ccaa664d20dcf5b125a2f",
"versionType": "git"
},
{
"status": "affected",
"version": "6.6.145",
"lessThan": "6.6.160",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.97",
"lessThan": "6.12.114",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.18.40",
"lessThan": "6.18.52",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.10.261",
"lessThan": "5.11",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.212",
"lessThan": "5.16",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.178",
"lessThan": "6.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.1.5",
"lessThan": "7.2",
"versionType": "semver"
}
],
"programFiles": [
"security/apparmor/domain.c",
"security/apparmor/include/policy.h",
"security/apparmor/policy.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "7.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"security/apparmor/domain.c",
"security/apparmor/include/policy.h",
"security/apparmor/policy.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-90179
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #48628 · Revision 1
- Added to Heist Feed
- Publisher date