CVE-2026-89762: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89762 Overview

CVE-2026-89762 is a use-after-free vulnerability in the Linux kernel's AppArmor Linux Security Module (LSM). The flaw resides in begin_current_label_crit_section(), a function invoked from numerous LSM hooks tied to virtual filesystem (VFS) and socket operations. When credentials are overridden and an AppArmor label is marked FLAG_STALE, the kernel can replace credentials incorrectly, leaving task->real_cred pointing to freed memory. A local, low-privileged user can trigger the condition, leading to kernel memory corruption and potential privilege escalation.

Critical Impact
A local attacker who can trigger AppArmor profile updates while holding overridden credentials may cause a kernel use-after-free, resulting in denial of service or privilege escalation.

Affected Products

Linux kernel builds with AppArmor LSM enabled
Distributions shipping AppArmor by default (Ubuntu, Debian, openSUSE, etc.)
Kernel branches prior to the fixes referenced in the stable git commits

Discovery Timeline

2026-09-11 - CVE-2026-89762 published to the National Vulnerability Database (NVD)
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89762

Vulnerability Analysis

AppArmor's begin_current_label_crit_section() checks whether the label attached to the current task's credentials carries FLAG_STALE. If so, it calls aa_replace_current_label() to swap in updated credentials referencing a new label. This behavior creates two distinct hazards inside a single LSM hook path.

First, kernel code that caches a const struct cred * from current_cred() before entering a security hook may dereference a freed pointer after the hook returns. Any read of fields such as cred->euid after the replacement is undefined behavior.

Second, aa_replace_current_label() attempts to detect overridden credentials by comparing current_cred() to current_real_cred(). The comparison fails to catch the case where both pointers reference the same struct cred due to an override that reused the objective creds. The replacement then drops references belonging to the override caller.

Root Cause

The root cause is unsafe in-hook credential replacement combined with an insufficient override detection check. When a task calls override_creds() with the same credentials already installed as objective creds, the equality check in aa_replace_current_label() cannot distinguish an overridden state from a normal state. AppArmor then replaces both task->cred and task->real_cred with new credentials and drops two references on the old credentials. When the override caller later invokes revert_creds() and releases its own reference, the final refcount reaches zero, freeing credentials that task->real_cred still points to.

Attack Vector

Exploitation is local and requires the ability to run code under an AppArmor-confined profile while another process (or the same process) manipulates the profile. The reporter demonstrated the flaw by running aa-disable against a profile while a confined process was blocked on splice() from a FUSE passthrough file into a full pipe. When the pipe drained and splice() resumed, credentials went out of sync. A subsequent getuid() syscall produced a KASAN use-after-free report, confirming freed memory access from the credential path. See the upstream commits referenced in the kernel stable tree for the technical fix.

Detection Methods for CVE-2026-89762

Indicators of Compromise

Kernel oops or panic messages referencing begin_current_label_crit_section, aa_replace_current_label, or apparmor_ LSM hooks
KASAN use-after-free reports involving struct cred allocations
Unexpected UID/GID transitions in processes confined by AppArmor profiles
Profile management activity (aa-disable, aa-enforce, apparmor_parser) correlated with process crashes

Detection Strategies

Enable KASAN and CONFIG_DEBUG_CREDENTIALS in test kernels to catch credential-related memory faults early
Monitor /var/log/kern.log and dmesg for AppArmor-related backtraces and use-after-free signatures
Audit invocations of aa-disable, aa-complain, and apparmor_parser --replace in production environments
Track FUSE mount activity from unprivileged users, since FUSE passthrough was central to the reproducer

Monitoring Recommendations

Alert on kernel crashes containing AppArmor symbols in the call trace
Correlate AppArmor profile reloads with process termination or unexpected credential changes
Collect and centralize kernel logs from Linux endpoints for retrospective analysis
Review syscall telemetry for suspicious use of override_creds()-adjacent paths such as io_uring workers and FUSE handlers

How to Mitigate CVE-2026-89762

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the stable commits as soon as vendor packages become available
Restrict unprivileged users from loading, replacing, or disabling AppArmor profiles
Limit unprivileged FUSE mount capability via sysctl or distribution-specific hardening options
Prioritize patching on multi-tenant Linux hosts and container hosts where local users are least trusted

Patch Information

The fix converts direct credential replacement in begin_current_label_crit_section() into deferred work executed via task_work at the end of the current syscall. This ensures no in-hook cred swap occurs while overridden credentials are active. AppArmor still performs direct replacements in the sb_pivotroot LSM hook and in proc_pid_attr_write(). The relevant stable kernel commits are 361488984d66, 3f4ae5fab613, 580f777d6d9f, and 587a6a92b93e. Consult your distribution's advisories for backported package versions.

Workarounds

Set AppArmor profiles to a stable state and avoid runtime profile disable/replace operations on production systems until patched
Disable AppArmor entirely only if an alternative LSM (e.g., SELinux) provides equivalent confinement and the operational risk is acceptable
Restrict CAP_MAC_ADMIN to trusted administrative accounts to prevent profile manipulation

bash

# Configuration example: restrict unprivileged FUSE and audit profile changes
sysctl -w fs.fuse.allow_other=0
auditctl -w /etc/apparmor.d/ -p wa -k apparmor_profile_change
auditctl -w /sbin/apparmor_parser -p x -k apparmor_parser_exec