CVE-2026-72461

CVE-2026-72461 is a reference count double-release in AppArmor's update_sk_ctx() function, but treating it as a single bug misses the point. The patch acquires an extra reference in the caller to work around a double-release—the developer's own comment admits this is a 'for now' fix and that the ideal solution would require making the caller conditionally handle ownership based on internal state. This is the tell: the function's reference ownership semantics were never properly specified, and the chosen workaround treats a design failure as an implementation bug, guaranteeing similar issues will surface in adjacent code paths. The EPSS score of 0.00136 is not reassurance—it indicates this lives in a code path that normal runtime doesn't exercise heavily (uncommon socket state transitions or error paths), which is exactly where refcount bugs hide. Low exploitation probability reflects 'hard to trigger' rather than 'safe,' and the real question is whether other callers of update_sk_ctx() or similar functions in AppArmor's socket context handling have the same conditional ownership ambiguity. What to do: First, audit the error path in the patched caller—does getting an extra reference create a leak if update_sk_ctx() fails partway through? Second, examine every other caller of this function and similar socket-context update functions for the same pattern. Third, treat this as a contract-specification problem: the function signature should encode ownership semantics so future callers cannot misuse it. The patch fixes this one bug; an audit determines whether it's an isolated incident or the surface symptom of a structural failure in how AppArmor handles reference ownership in its socket context layer.

Reviewed through automated stages and approved by a human before publication.