CVE-2026-72462

The race condition in AppArmor's unix socket mediation (CVE-2026-72462) carries a CVSS 8.8, but the practical exploitability is narrower than the score implies. The core issue is a data lifetime problem: peer_path information lives in memory managed by unix_release_sock(), which runs asynchronously to AppArmor's mediation checks. A policy decision about socket access can be made against data that is simultaneously being freed by another thread. Holding a reference to a socket structure does not guarantee the stability of its associated path data. The commit message reveals something more valuable than the CVE description: the developers explicitly acknowledged taking the expedient path. The ideal fix — caching peer_path information for connected sockets to eliminate repeated lock acquisition — was considered and deferred. They chose to serialize access with a state lock rather than refactor the architecture. That trade-off was made without apparent security review of the alternative, and the deferred fix will likely remain deferred; kernel security commits that defer architectural refactoring rarely see that refactoring land in subsequent updates. This matters because the fix creates a predictable downstream trajectory: race discovered, lock added to serialize access, lock becomes a contention point under socket-heavy workloads, DoS vector emerges. If every peer_path access now takes the state lock, container runtimes and orchestration systems with high socket turnover may experience latency spikes — a secondary risk the CVSS score doesn't capture. The narrow exploit window shouldn't deprioritise this. The EPSS score of 0.00136 reflects low near-term exploitation probability, but the real blast radius is specific to deployments where AppArmor is the primary containment mechanism — already-hardened container runtimes and sandboxed applications. When the enforcement layer itself has a race condition, the vulnerability doesn't give an attacker a foothold into a random Linux system; it gives them a way to violate security guarantees that a hardened system was designed to provide. The audit trail integrity is also questionable: if peer_path data is corrupted during the mediation check itself, the violation may execute without leaving a reliable record. This unix socket data-lifetime pattern has surfaced multiple times in recent kernel history. Each fix synchronizes locally without addressing why the lifetime model keeps producing these windows. Organizations using AppArmor profiles as their primary containment mechanism should treat this as higher priority than EPSS suggests — not because the race is likely to be directly weaponized, but because it signals that the isolation boundary rests on assumptions about data lifetime that don't hold under concurrent access. The next vulnerability in this code path will inherit this race.

Reviewed through automated stages and approved by a human before publication.