CVE-2022-50860: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50860 is a memory leak vulnerability in the Linux kernel's AppArmor mandatory access control module, specifically within the alloc_ns() function. Following changes introduced by commit a1bd627b46d1 ("apparmor: share profile name on replacement"), the hname member of struct aa_policy is no longer a valid slab object but a subset of one, causing improper memory deallocation when kfree_sensitive() is used instead of the correct aa_policy_destroy() function. The vulnerability affects Linux kernel versions from commit a1bd627b46d1 onward, introduced as early as kernel 4.13, and was publicly disclosed on December 30, 2025. The CVSS base score is not formally assigned (estimated Medium severity), and the EPSS score is approximately 0.018% (Red Hat CVE, Feedly).

The root cause is a memory management error (CWE-401: Missing Release of Memory after Effective Lifetime) in the AppArmor kernel module. After commit a1bd627b46d1 changed how profile names are shared on replacement, the hname field in struct aa_policy points into the middle of a larger allocation rather than being an independently allocated slab object. Calling kfree_sensitive() on this non-standalone pointer results in a memory leak each time a namespace is allocated and subsequently freed. The fix replaces the incorrect kfree_sensitive() call with aa_policy_destroy(), which correctly handles the policy name cleanup (Red Hat CVE, EUVD).

The primary impact is a gradual kernel memory leak that can degrade system performance and, under sustained exploitation or heavy workload, lead to out-of-memory (OOM) conditions and denial of service. Because the leak occurs within the AppArmor security module — which is widely deployed in security-hardened Linux distributions such as Ubuntu and Debian — systems relying on AppArmor for mandatory access control enforcement are particularly at risk. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

Update the Linux kernel to a patched version: 5.10.163 or later, 5.15.86 or later, 6.0.16 or later, 6.1.2 or later, or 6.2 or later. The fixes are contained in upstream git commits 9a32aa87a25d, 5f509fa740b1, 0250cf8d37bb, 12695b4b76d4, and e9e6fa49dbab. As a temporary measure prior to patching, monitor kernel memory usage (e.g., via /proc/meminfo or kernel OOM logs) on systems running affected versions that make heavy use of AppArmor namespaces (Red Hat CVE, Feedly).