Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to audit_log_untrustedstring() Commit… (CVE-2026-72455)
Severity: mediumType: VulnerabilityCVE-2026-72455
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to audit_log_untrustedstring() Commit 4a134723f9f1 ("apparmor: move check for aa_null file to cover all cases") intrdouced a small bug, where path_name() may pass a potentially uninitialized *name to aa_audit_file() if the path->dentry had been replaced with aa_null.dentry earlier on. This can lead to page fault like one observed on 7.0.2 openSUSE Tumbleweed kernel: [51692.242756] [ T24690] BUG: unable to handle page fault for address: 0000000f00000003 [51692.242762] [ T24690] #PF: supervisor read access in kernel mode [51692.242763] [ T24690] #PF: error_code(0x0000) - not-present page [51692.242765] [ T24690] PGD 0 P4D 0 [51692.242768] [ T24690] Oops: Oops: 0000 [#1] SMP NOPTI [51692.242772] [ T24690] CPU: 3 UID: 1020 PID: 24690 Comm: snap-confine Tainted: G O 7.0.2-1-default #1 PREEMPT(full) openSUSE Tumbleweed ab90b4c9940707f9cafa19bdad80b2cec52dbe51 [51692.242775] [ T24690] Tainted: [O]=OOT_MODULE [51692.242777] [ T24690] Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP05, BIOS 03.18 01/08/2026 [51692.242778] [ T24690] RIP: 0010:strlen+0x4/0x30 [51692.242783] [ T24690] Code: f7 75 ec 31 c0 e9 17 9f 00 ff 48 89 f8 e9 0f 9f 00 ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 18 48 89 f8 0f 1f 40 00 48 83 c0 01 80 38 00 75 f7 48 [51692.242785] [ T24690] RSP: 0018:ffffd015eb1e3608 EFLAGS: 00010282 [51692.242787] [ T24690] RAX: 0000000000000000 RBX: ffff89796198a360 RCX: 0000000000000000 [51692.242788] [ T24690] RDX: 00000000000000d1 RSI: 0000000f00000003 RDI: 0000000f00000003 [51692.242790] [ T24690] RBP: ffffffffb7ede090 R08: 00000000000005f5 R09: 0000000000000000 [51692.242791] [ T24690] R10: 0000000000000000 R11: 0000000000000000 R12: ffffd015eb1e3700 [51692.242792] [ T24690] R13: ffff8977a22bc380 R14: ffffffffb7ec5190 R15: ffff8977a0c8aa80 [51692.242794] [ T24690] FS: 0000000000000000(0000) GS:ffff897f640d8000(0000) knlGS:0000000000000000 [51692.242796] [ T24690] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [51692.242797] [ T24690] CR2: 0000000f00000003 CR3: 00000006ad15f000 CR4: 0000000000f50ef0 [51692.242799] [ T24690] PKRU: 55555554 [51692.242800] [ T24690] Call Trace: [51692.242802] [ T24690] <TASK> [51692.242804] [ T24690] audit_log_untrustedstring+0x1d/0x40 [51692.242811] [ T24690] common_lsm_audit+0x71/0x1d0 [51692.242816] [ T24690] aa_audit+0x5a/0x170 [51692.242819] [ T24690] aa_audit_file+0x18a/0x1b0 [51692.242825] [ T24690] path_name+0xd2/0x100 [51692.242829] [ T24690] profile_path_perm.part.0+0x58/0xb0 [51692.242832] [ T24690] aa_path_perm+0xef/0x150 [51692.242837] [ T24690] apparmor_file_open+0x153/0x2e0 [51692.242840] [ T24690] security_file_open+0x46/0xd0 [51692.242844] [ T24690] do_dentry_open+0xe9/0x4d0 [51692.242848] [ T24690] vfs_open+0x30/0x100 While here, initialise variables which are passed down to path_name().
AI Analysis
Technical Summary
The vulnerability in the Linux kernel AppArmor component was caused by a commit that introduced a bug where path_name() could pass an uninitialized pointer to aa_audit_file() when the path's dentry was replaced with aa_null.dentry. This led to an uninitialized pointer being passed to audit_log_untrustedstring(), resulting in a kernel page fault and system crash. The issue was observed in kernel version 7.0.2 on openSUSE Tumbleweed. The fix involved initializing variables passed to path_name() to prevent passing uninitialized pointers.
Potential Impact
This vulnerability can cause a kernel page fault leading to a system crash (kernel oops) when AppArmor processes certain file paths. It affects system stability but does not have confirmed exploitation or privilege escalation details. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to initialize variables passed to path_name(), preventing uninitialized pointers from being used. Users should update their Linux kernel to a version that includes this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the exact fixed version and apply the update accordingly.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to audit_log_untrustedstring() Commit… (CVE-2026-72455)
Severity: medium
Type: Vulnerability
CVE: CVE-2026-72455
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to audit_log_untrustedstring() Commit 4a134723f9f1 ("apparmor: move check for aa_null file to cover all cases") intrdouced a small bug, where path_name() may pass a potentially uninitialized *name to aa_audit_file() if the path->dentry had been replaced with aa_null.dentry earlier on. This can lead to page fault like one observed on 7.0.2 openSUSE Tumbleweed kernel: [51692.242756] [ T24690] BUG: unable to handle page fault for address: 0000000f00000003 [51692.242762] [ T24690] #PF: supervisor read access in kernel mode [51692.242763] [ T24690] #PF: error_code(0x0000) - not-present page [51692.242765] [ T24690] PGD 0 P4D 0 [51692.242768] [ T24690] Oops: Oops: 0000 [#1] SMP NOPTI [51692.242772] [ T24690] CPU: 3 UID: 1020 PID: 24690 Comm: snap-confine Tainted: G O 7.0.2-1-default #1 PREEMPT(full) openSUSE Tumbleweed ab90b4c9940707f9cafa19bdad80b2cec52dbe51 [51692.242775] [ T24690] Tainted: [O]=OOT_MODULE [51692.242777] [ T24690] Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP05, BIOS 03.18 01/08/2026 [51692.242778] [ T24690] RIP: 0010:strlen+0x4/0x30 [51692.242783] [ T24690] Code: f7 75 ec 31 c0 e9 17 9f 00 ff 48 89 f8 e9 0f 9f 00 ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 18 48 89 f8 0f 1f 40 00 48 83 c0 01 80 38 00 75 f7 48 [51692.242785] [ T24690] RSP: 0018:ffffd015eb1e3608 EFLAGS: 00010282 [51692.242787] [ T24690] RAX: 0000000000000000 RBX: ffff89796198a360 RCX: 0000000000000000 [51692.242788] [ T24690] RDX: 00000000000000d1 RSI: 0000000f00000003 RDI: 0000000f00000003 [51692.242790] [ T24690] RBP: ffffffffb7ede090 R08: 00000000000005f5 R09: 0000000000000000 [51692.242791] [ T24690] R10: 0000000000000000 R11: 0000000000000000 R12: ffffd015eb1e3700 [51692.242792] [ T24690] R13: ffff8977a22bc380 R14: ffffffffb7ec5190 R15: ffff8977a0c8aa80 [51692.242794] [ T24690] FS: 0000000000000000(0000) GS:ffff897f640d8000(0000) knlGS:0000000000000000 [51692.242796] [ T24690] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [51692.242797] [ T24690] CR2: 0000000f00000003 CR3: 00000006ad15f000 CR4: 0000000000f50ef0 [51692.242799] [ T24690] PKRU: 55555554 [51692.242800] [ T24690] Call Trace: [51692.242802] [ T24690] <TASK> [51692.242804] [ T24690] audit_log_untrustedstring+0x1d/0x40 [51692.242811] [ T24690] common_lsm_audit+0x71/0x1d0 [51692.242816] [ T24690] aa_audit+0x5a/0x170 [51692.242819] [ T24690] aa_audit_file+0x18a/0x1b0 [51692.242825] [ T24690] path_name+0xd2/0x100 [51692.242829] [ T24690] profile_path_perm.part.0+0x58/0xb0 [51692.242832] [ T24690] aa_path_perm+0xef/0x150 [51692.242837] [ T24690] apparmor_file_open+0x153/0x2e0 [51692.242840] [ T24690] security_file_open+0x46/0xd0 [51692.242844] [ T24690] do_dentry_open+0xe9/0x4d0 [51692.242848] [ T24690] vfs_open+0x30/0x100 While here, initialise variables which are passed down to path_name().
Technical Summary
The vulnerability in the Linux kernel AppArmor component was caused by a commit that introduced a bug where path_name() could pass an uninitialized pointer to aa_audit_file() when the path's dentry was replaced with aa_null.dentry. This led to an uninitialized pointer being passed to audit_log_untrustedstring(), resulting in a kernel page fault and system crash. The issue was observed in kernel version 7.0.2 on openSUSE Tumbleweed. The fix involved initializing variables passed to path_name() to prevent passing uninitialized pointers.
Potential Impact
This vulnerability can cause a kernel page fault leading to a system crash (kernel oops) when AppArmor processes certain file paths. It affects system stability but does not have confirmed exploitation or privilege escalation details. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to initialize variables passed to path_name(), preventing uninitialized pointers from being used. Users should update their Linux kernel to a version that includes this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the exact fixed version and apply the update accordingly.
Source: GCVE Database
Published: 08/15/2026
EPSS 0.2%top 95%
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to audit_log_untrustedstring() Commit… (CVE-2026-72455)
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
AILast updated: 08/15/2026, 16:21:26 UTC
Technical Analysis
The vulnerability in the Linux kernel AppArmor component was caused by a commit that introduced a bug where path_name() could pass an uninitialized pointer to aa_audit_file() when the path's dentry was replaced with aa_null.dentry. This led to an uninitialized pointer being passed to audit_log_untrustedstring(), resulting in a kernel page fault and system crash. The issue was observed in kernel version 7.0.2 on openSUSE Tumbleweed. The fix involved initializing variables passed to path_name() to prevent passing uninitialized pointers.
Potential Impact
This vulnerability can cause a kernel page fault leading to a system crash (kernel oops) when AppArmor processes certain file paths. It affects system stability but does not have confirmed exploitation or privilege escalation details. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to initialize variables passed to path_name(), preventing uninitialized pointers from being used. Users should update their Linux kernel to a version that includes this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the exact fixed version and apply the update accordingly.
Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro
Technical Details
Gcve Source
db.gcve.eu
Osv Id
GHSA-r85g-hm8c-rxmx
Osv Schema Version
1.4.0
Aliases
["CVE-2026-72455"]
Threat ID: 6a808b6dbf8831d5394f8e4d
Added to database: 08/15/2026, 15:53:17 UTC
Last enriched: 08/15/2026, 16:21:26 UTC
Last updated: 09/30/2026, 06:54:41 UTC
Views: 31
Community Reviews
0 reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Sort by
Loading community insights…
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.