CVE-2026-89761

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix out-of-bounds write when null terminating a label vec

aa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE

is passed. If the components are all distinct no duplicates are dropped,

dups is 0 and the terminator goes to vec[n], so the caller has to provide

room for n + 1 entries.

aa_label_strn_parse() sets up its vector with vec_setup(profile, vec, len,

gfp) and then calls aa_vec_unique(vec, len, VEC_FLAG_TERMINATE), but

vec_setup() does not reserve the terminator entry. Up to LOCAL_VEC_ENTRIES

it uses the local array of LOCAL_VEC_ENTRIES pointers, above that it

allocates exactly len pointers. The terminator therefore lands one entry

past the end of the local array when len is LOCAL_VEC_ENTRIES, and one

entry past the end of the allocation when len is larger.

len comes from the number of "//&" separated components in the label name

and label_count_strn_entries() does not bound it. An

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References