Bug 2516449 (CVE-2026-72462)

Summary: CVE-2026-72462 kernel: apparmor: fix race in unix socket mediation when peer_path is used
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's AppArmor security module. A race condition exists in the Unix socket mediation when handling the `peer_path`. This allows for a race with `unix_release_sock()` due to accessing the peer socket path outside of the necessary state lock. This could potentially lead to incorrect access control decisions or other unspecified security bypasses.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:13:08 UTC 
In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix race in unix socket mediation when peer_path is used

The holding a reference to the peer_sk is not enough to ensure access
to the peer sk path. Accessing the path outside of the state lock
allows for a race with unix_release_sock(). Fix this by taking the
state lock and getting a reference to the path under lock.

Ideally for connected sockets we would cache this information so we
don't have to take the lock here. But for now just fix the race.
Comment 1 Keith Grant 2026-08-19 17:24:34 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081533-CVE-2026-72462-ce30@gregkh/T