CVE-2026-89762

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix cred UAF caused by begin_current_label_crit_section()

AppArmor's begin_current_label_crit_section() is a scary function called

from lots of LSM hooks (in particular VFS/socket-related ones) that checks

if the label referenced by the current creds is marked FLAG_STALE, and if

so, attempts to use aa_replace_current_label() to replace the creds with an

updated version that uses a new label.

The first problem with this is that it would directly lead to UAF of

`struct cred` if anything in the kernel takes a pointer to the current

creds and accesses these past a security hook invocation that replaces

creds, like so:

```

const struct cred *cred = current_cred();

alloc_file_pseudo(...);

uid_t uid = cred->euid;

```

I don't know if anything in the kernel actually does this, but I think it

is very surprising that this pattern could lead to UAF.

The second problem is that things go wrong when aa_replace_current_l

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References