From: John Johansen Date: Mon, 13 Apr 2026 06:39:16 +0000 (-0700) Subject: apparmor: Fix double free of ns_name in aa_replace_profiles() X-Git-Tag: v6.1.169~39 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=35f4caec1352054b9a61cfdf2bf1898073637aa0;p=thirdparty%2Fkernel%2Fstable.git apparmor: Fix double free of ns_name in aa_replace_profiles() commit 5df0c44e8f5f619d3beb871207aded7c78414502 upstream. if ns_name is NULL after 1071 error = aa_unpack(udata, &lh, &ns_name); and if ent->ns_name contains an ns_name in 1089 } else if (ent->ns_name) { then ns_name is assigned the ent->ns_name 1095 ns_name = ent->ns_name; however ent->ns_name is freed at 1262 aa_load_ent_free(ent); and then again when freeing ns_name at 1270 kfree(ns_name); Fix this by NULLing out ent->ns_name after it is transferred to ns_name Fixes: 145a0ef21c8e9 ("apparmor: fix blob compression when ns is forced on a policy load ") Reported-by: Qualys Security Advisory Tested-by: Salvatore Bonaccorso Reviewed-by: Georgia Garcia Reviewed-by: Cengiz Can Signed-off-by: John Johansen Signed-off-by: Greg Kroah-Hartman --- diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index a4406a7f753c6..fa8cdcb3a3568 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -958,6 +958,7 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label, goto fail; } ns_name = ent->ns_name; + ent->ns_name = NULL; } else count++; }