CVE-2026-72461 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix refcount leak when updating the sk_ctx

Currently update_sk_ctx() transfers the plabel reference, unfortunately
it is also unconditionally put in the caller. Ideally we would make
the caller conditionally put the reference based on whether it was
transferred but for now just fix the bug by getting a reference.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux Subscribe	Linux Kernel Subscribe

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://git.kernel.org/stable/c/045dbe89ac31709abd73390d0805d52fece7ef39
https://git.kernel.org/stable/c/6d25e7b47616cb2db43351210929c8f19dc305a3
https://git.kernel.org/stable/c/b8642f1478982a97ca2eb59f70f631a9de42ae11

History

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the sk_ctx Currently update_sk_ctx() transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the reference based on whether it was transferred but for now just fix the bug by getting a reference.
Title		apparmor: fix refcount leak when updating the sk_ctx
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/045dbe89ac31709abd73390d0805d52fece7ef39 https://git.kernel.org/stable/c/6d25e7b47616cb2db43351210929c8f19dc305a3 https://git.kernel.org/stable/c/b8642f1478982a97ca2eb59f70f631a9de42ae11

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:57:06.042Z

Updated: 2026-08-15T05:57:06.042Z

Reserved: 2026-08-09T03:40:39.933Z

Link: CVE-2026-72461

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:20.113

Modified: 2026-08-15T06:22:20.113

Link: CVE-2026-72461

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72461", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.933Z", "datePublished": "2026-08-15T05:57:06.042Z", "dateUpdated": "2026-08-15T05:57:06.042Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-15T05:57:06.042Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix refcount leak when updating the sk_ctx\n\nCurrently update_sk_ctx() transfers the plabel reference, unfortunately\nit is also unconditionally put in the caller. Ideally we would make\nthe caller conditionally put the reference based on whether it was\ntransferred but for now just fix the bug by getting a reference."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/apparmor/af_unix.c"], "versions": [{"version": "88fec3526e84123997ecebd6bb6778eb4ce779b7", "lessThan": "045dbe89ac31709abd73390d0805d52fece7ef39", "status": "affected", "versionType": "git"}, {"version": "88fec3526e84123997ecebd6bb6778eb4ce779b7", "lessThan": "b8642f1478982a97ca2eb59f70f631a9de42ae11", "status": "affected", "versionType": "git"}, {"version": "88fec3526e84123997ecebd6bb6778eb4ce779b7", "lessThan": "6d25e7b47616cb2db43351210929c8f19dc305a3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/apparmor/af_unix.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/045dbe89ac31709abd73390d0805d52fece7ef39"}, {"url": "https://git.kernel.org/stable/c/b8642f1478982a97ca2eb59f70f631a9de42ae11"}, {"url": "https://git.kernel.org/stable/c/6d25e7b47616cb2db43351210929c8f19dc305a3"}], "title": "apparmor: fix refcount leak when updating the sk_ctx", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["security/apparmor/af_unix.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "045dbe89ac31709abd73390d0805d52fece7ef39", "status": "affected", "version": "88fec3526e84123997ecebd6bb6778eb4ce779b7", "versionType": "git"}, {"lessThan": "b8642f1478982a97ca2eb59f70f631a9de42ae11", "status": "affected", "version": "88fec3526e84123997ecebd6bb6778eb4ce779b7", "versionType": "git"}, {"lessThan": "6d25e7b47616cb2db43351210929c8f19dc305a3", "status": "affected", "version": "88fec3526e84123997ecebd6bb6778eb4ce779b7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["security/apparmor/af_unix.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix refcount leak when updating the sk_ctx\n\nCurrently update_sk_ctx() transfers the plabel reference, unfortunately\nit is also unconditionally put in the caller. Ideally we would make\nthe caller conditionally put the reference based on whether it was\ntransferred but for now just fix the bug by getting a reference."}], "id": "CVE-2026-72461", "lastModified": "2026-08-15T06:22:20.113", "metrics": {}, "published": "2026-08-15T06:22:20.113", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/045dbe89ac31709abd73390d0805d52fece7ef39"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6d25e7b47616cb2db43351210929c8f19dc305a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b8642f1478982a97ca2eb59f70f631a9de42ae11"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}