CVE-2026-72459 apparmor: aa_label_alloc use aa_label_free on alloc failure
A resource leak in the Linux kernel AppArmor module can lead to memory exhaustion and denial of service when label allocation fails.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72459?
CVE-2026-72459 is a high-severity memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
apparmor: aa_label_alloc use aa_label_free on alloc failure
aa_label_alloc() allocates a secid before allocating or taking the label proxy. If the later proxy step fails, the error path only freed the label memory, leaking any resources initialized by aa_label_init().
Use aa_label_free() on the failure path so partially initialized labels release their secid and other label resources before the backing memory is freed.
Which versions are affected by CVE-2026-72459?
How do I fix CVE-2026-72459?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-72459 being exploited?
There is no known exploitation of CVE-2026-72459 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72459, DEBIAN-CVE-2026-72459, GHSA-787x-f6pf-8wg4, UBUNTU-CVE-2026-72459.