In the Linux kernel, the following vulnerability has been resolved:
apparmor: avoid per-cpu hold underflow in aa_get_buffer
When aa_get_buffer() pulls from the per-cpu list it unconditionally decrements cache->hold. If hold reaches 0 while count is still non-zero, the unsigned decrement wraps to UINT_MAX. This keeps hold non-zero for a very long time, so aa_put_buffer() never returns buffers to the global list, which can starve other CPUs and force repeated kmalloc(aa_g_path_max) allocations.
Guard the decrement so hold never underflows.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1029-nvidia-tegra-rtUpgrade linux-image-6.8.0-1057-oracle-64kUpgrade linux-image-azure-fips-6.8Upgrade linux-image-aws-64k-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-134-genericUpgrade linux-image-realtimeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oem-20.04dUpgrade linux-image-gke-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-awsUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-raspiUpgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-xilinxUpgrade linux-image-6.8.0-1060-raspiUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1063-azureUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-134-fipsUpgrade linux-image-kvmUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1062-azure-fdeUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-1057-oracleUpgrade linux-image-laptop-23.10Upgrade linux-image-6.8.0-136-genericUpgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-1062-azure-fipsUpgrade linux-image-gcp-fipsUpgrade linux-image-gke-64k-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1045-gkeopUpgrade linux-image-azure-fdeUpgrade linux-image-generic-64k-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-oracleUpgrade linux-image-xilinx-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-azure-lts-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1058-gkeUpgrade linux-image-6.8.0-1063-gcp-64kUpgrade linux-image-6.8.0-134-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1058-nvidia-lowlatency-64kUpgrade linux-image-ibm-6.8Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-fips-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-aws-fips-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-nvidia-tegraUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1058-nvidia-64kUpgrade linux-image-6.8.0-1060-ibmUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-aws-6.8Upgrade linux-image-ibmUpgrade linux-image-6.8.0-1029-nvidia-tegraUpgrade linux-image-6.8.0-1032-xilinxUpgrade linux-image-6.8.0-1058-nvidia-lowlatencyUpgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-136-generic-64kUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-oem-22.04aUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-2049-raspi-realtimeUpgrade linux-image-6.8.0-134-lowlatency-64kUpgrade linux-image-6.8.0-134-generic-64kUpgrade linux-image-6.8.0-1063-gcp-fipsUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1058-gke-64kUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-generic-64kUpgrade linux-image-azure-fde-6.8Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1063-gcpUpgrade linux-image-6.8.0-1060-aws-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-genericUpgrade linux-image-6.8.0-1060-aws-64kUpgrade linux-image-virtualUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-oem-20.04cUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gke-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-lowlatency-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-fipsUpgrade linux-image-azureUpgrade linux-image-aws-fipsUpgrade linux-image-6.8.1-1055-realtimeUpgrade linux-image-6.8.0-1060-awsUpgrade linux-image-6.8.0-1058-nvidiaUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gcp-64kUpgrade linux-image-oem-20.04b | Jul 2, 2026 | Jul 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub