CVE-2026-90179

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix deadlock in complain-mode change_hat

The use of change_hat when in complain mode can cause a deadlock

when the hat doesn't exist and a new learning profile is created

for the missing profile. This is because change_hat() has taken

the lock to search the hat list and creating the new learning

profile needs to take the lock to add it to the list.

From the bug report:

Originally found in 7.0.0 in LTS ubuntu 26.04 with pam_apparmor + su

in complain mode set to change hats. Then verified in newest

available vanilla kernel I've compiled to see if still present:

7.2-rc7 vanilla -> affected

checked also some other kernels:

6.18.44 vanilla -> affected

6.12.95 with debian patches -> unaffected

On systems without bug (for example 6.12.95 debian) it just prints:

aa_change_hat rc=0

On systems with bug, the executable always hangs, prints nothing and

becomes unkillable. (And once stuck this way, it will caus

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References