CVE-2026-72455

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix uninitialised pointer passed to audit_log_untrustedstring()

Commit 4a134723f9f1 ("apparmor: move check for aa_null file to cover all cases")

intrdouced a small bug, where path_name() may pass a potentially uninitialized

*name to aa_audit_file() if the path->dentry had been replaced with

aa_null.dentry earlier on. This can lead to page fault like one observed on

7.0.2 openSUSE Tumbleweed kernel:

[51692.242756] [ T24690] BUG: unable to handle page fault for address: 0000000f00000003

[51692.242762] [ T24690] #PF: supervisor read access in kernel mode

[51692.242763] [ T24690] #PF: error_code(0x0000) - not-present page

[51692.242765] [ T24690] PGD 0 P4D 0

[51692.242768] [ T24690] Oops: Oops: 0000 [#1] SMP NOPTI

[51692.242772] [ T24690] CPU: 3 UID: 1020 PID: 24690 Comm: snap-confine Tainted: G O 7.0.2-1-default #1 PREEMPT(full) openSUSE Tumbleweed ab90b4c9940707f9cafa19bdad80b2cec52db

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References