{"id":28509,"date":"2026-09-25T00:31:34","date_gmt":"2026-09-24T16:31:34","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93245"},"modified":"2026-09-25T00:31:34","modified_gmt":"2026-09-24T16:31:34","slug":"cve-2026-93245","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93245","title":{"rendered":"CVE-2026-93245 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: policy_int"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>apparmor: policy_int make sure list heads are initialized before fail path<\/p>\n<p>If profile create fails before policy_init is complete the list heads<br \/>\nare not properly initialized causing profile_free() sanity checks to<br \/>\ntrigger the following splat.<\/p>\n<p>AppArmor WARN aa_policy_destroy: (((!list_empty(&amp;policy-&gt;profiles) &amp;&amp; (&amp;policy-&gt;profiles)-&gt;prev != ((void *) 0x122 + (0xdead000000000000UL))))):<br \/>\nWARNING: security\/apparmor\/lib.c:509 at aa_policy_destroy+0x164\/0x1b0 security\/apparmor\/lib.c:509, CPU#0: syz.0.17\/5541<br \/>\nModules linked in:<br \/>\nCPU: 0 UID: 0 PID: 5541 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)<br \/>\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04\/01\/2014<br \/>\nRIP: 0010:aa_policy_destroy+0x16b\/0x1b0 security\/apparmor\/lib.c:509<br \/>\nCode: 85 ed 7e 4d e8 96 bc 37 fd 5b 41 5c 41 5e 41 5f 5d e9 19 27 4e 07 cc e8 83 bc 37 fd 48 8d 3d 0c f0 d3 0b 48 c7 c6 a4 eb 38 8e  48 0f b9 3a e9 04 ff ff ff e8 66 bc 37 fd 48 8d 3d ff ef d3 0b<br \/>\nRSP: 0018:ffffc9000345eaa0 EFLAGS: 00010293<br \/>\nRAX: ffffffff848f530d RBX: ffff88803f734800 RCX: ffff88801af2a580<br \/>\nRDX: 0000000000000000 RSI: ffffffff8e38eba4 RDI: ffffffff90634320<br \/>\nRBP: 0000000000000000 R08: 0000000000000cc0 R09: 00000000ffffffff<br \/>\nR10: dffffc0000000000 R11: fffffbfff1d95913 R12: dead000000000122<br \/>\nR13: ffff88803f734800 R14: ffff88803f734828 R15: dffffc0000000000<br \/>\nFS:  00007f5f6a1836c0(0000) GS:ffff88808c519000(0000) knlGS:0000000000000000<br \/>\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br \/>\nCR2: 000055d02407b048 CR3: 0000000012aa9000 CR4: 0000000000352ef0<br \/>\nCall Trace:<\/p>\n<p> aa_free_profile+0x9d\/0x9f0 security\/apparmor\/policy.c:334<br \/>\n aa_alloc_profile+0x1e4\/0x3e0 security\/apparmor\/policy.c:416<br \/>\n unpack_profile security\/apparmor\/policy_unpack.c:1153 [inline]<br \/>\n aa_unpack+0x17db\/0x7430 security\/apparmor\/policy_unpack.c:1748<br \/>\n aa_replace_profiles+0x226\/0x2a20 security\/apparmor\/policy.c:1183<br \/>\n policy_update+0x234\/0x4a0 security\/apparmor\/apparmorfs.c:505<br \/>\n profile_load+0x1cb\/0x320 security\/apparmor\/apparmorfs.c:522<br \/>\n vfs_write+0x296\/0xba0 fs\/read_write.c:685<br \/>\n ksys_write+0x150\/0x270 fs\/read_write.c:739<br \/>\n do_syscall_x64 arch\/x86\/entry\/syscall_64.c:61 [inline]<br \/>\n do_syscall_64+0x166\/0x520 arch\/x86\/entry\/syscall_64.c:84<br \/>\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<br \/>\nRIP: 0033:0x7f5f6939e0d9<br \/>\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05  3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48<br \/>\nRSP: 002b:00007f5f6a183028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001<br \/>\nRAX: ffffffffffffffda RBX: 00007f5f69625fa0 RCX: 00007f5f6939e0d9<br \/>\nRDX: 0000000000000041 RSI: 0000200000000400 RDI: 0000000000000003<br \/>\nRBP: 00007f5f6a183090 R08: 0000000000000000 R09: 0000000000000000<br \/>\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001<br \/>\nR13: 00007f5f69626038 R14: 00007f5f69625fa0 R15: 00007ffe23725c18<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>apparmor: policy_int make sure list heads are initialized before fail path<\/p>\n<p>If profile create fails before policy_init is complete <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28509","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28509","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28509"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28509"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28509"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}