Skip to content
Heist/ feed
High

apparmor: fix cred UAF caused by begin_current_label_crit_section()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begin_current_label_crit_section() AppArmor's begin_current_label_crit_section() is a scary function called from lots of LSM hooks (in particular VFS/socket-related ones) that checks if the label referenced by the current creds is marked FLAG_STALE, and if so, attempts to use aa_replace_current_label() to replace the creds with an updated version that uses a new label. The first problem with this is that it would directly lead to UAF of `struct cred` if anything in the kernel takes a pointer to the current creds and accesses these past a security hook invocation that replaces creds, like so: ``` const struct cred *cred = current_cred(); alloc_file_pseudo(...); uid_t uid = cred->euid; ``` I don't know if anything in the kernel actually does this, but I think it is very surprising that this pattern could lead to UAF. The second problem is that things go wrong when aa_replace_current_label() runs with overridden credentials. aa_replace_current_label() bails out if `current_cred() != current_real_cred()` (mirroring the check in proc_pid_attr_write()), but this check can't actually reliably detect overridden credentials because the overridden creds can be the same as the objective creds. So in approximately the following scenario, things go wrong: 1. task begins with (as both objective and subjective creds), with refcount=2 2. task grabs an extra reference on for overriding 3. task

Announced Source revision 1
Original source ↗

CVE-2026-89762

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-89762

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "c75afcd153f6147d3b094f45a1d87e5df7f4f053",
        "lessThan": "089f10b47843a86fa03a8c20799c9353660e5288",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c75afcd153f6147d3b094f45a1d87e5df7f4f053",
        "lessThan": "361488984d668235438faac28635f3632351407f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c75afcd153f6147d3b094f45a1d87e5df7f4f053",
        "lessThan": "587a6a92b93ec314c583bbf747413af170d42540",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c75afcd153f6147d3b094f45a1d87e5df7f4f053",
        "lessThan": "580f777d6d9fd07fc034bd1aeba5c30fd48871a2",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c75afcd153f6147d3b094f45a1d87e5df7f4f053",
        "lessThan": "3f4ae5fab613dca01d6a2a8210dd832e009fcf47",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "security/apparmor/include/cred.h",
      "security/apparmor/include/task.h",
      "security/apparmor/task.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.36"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "2.6.36",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.109",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.50",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.4",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "security/apparmor/include/cred.h",
      "security/apparmor/include/task.h",
      "security/apparmor/task.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-89762

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#46722 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement