CVE-2026-89761: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-89761 is an out-of-bounds write vulnerability in the Linux kernel's AppArmor security module, specifically in the label parsing functionality. The flaw exists in aa_label_strn_parse(), which fails to allocate sufficient buffer space for a null terminator when calling aa_vec_unique() with the VEC_FLAG_TERMINATE flag, causing a one-entry overwrite past the end of the allocated buffer. It affects Linux kernel versions from 4.13 onward, with fixes available in stable releases 6.12.109, 6.18.50, and 7.2.4. It was published on September 11, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Github Advisory).

The root cause is an out-of-bounds write (CWE-787) in the AppArmor label parsing code. aa_vec_unique() writes a null terminator at vec[n - dups]; when no duplicates exist (dups == 0), it writes to vec[n], one position beyond the allocated buffer. vec_setup() allocates exactly len pointers (or uses a fixed-size local array of LOCAL_VEC_ENTRIES pointers), but does not reserve the extra slot required for the terminator. The number of "//&" separated components in the label name (len) is not bounded by label_count_strn_entries(). An unprivileged local user can trigger this by writing a crafted label name to /proc/self/attr/apparmor/current, via the lsm_set_self_attr(2) syscall, or through the world-writable (mode 0666) securityfs .access file — all paths that parse the label before any permission check. A system with AppArmor policy loaded is required, as each component must resolve to a loaded profile (Red Hat Bugzilla, Github Advisory).

Successful exploitation can result in kernel memory corruption, potentially leading to local privilege escalation or denial of service. An unprivileged local user could overwrite adjacent kernel memory structures, enabling arbitrary code execution in kernel context and full system compromise. The confidentiality, integrity, and availability impacts are all rated High, reflecting the potential for an attacker to escalate privileges, crash the system, or access sensitive kernel data (Red Hat Bugzilla, Github Advisory).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat Advisory). The EPSS score is approximately 0.156% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The attack requires only low privileges and no user interaction, lowering the bar for exploitation once a PoC becomes available.

1. Prerequisite check: Confirm the target Linux system has AppArmor enabled and at least one AppArmor profile loaded, as each label component must resolve to a loaded profile.
2. Craft a malicious label name: Construct a label string containing multiple "//&" separated components (e.g., profile1//&profile2//&...//&profileN) where N equals LOCAL_VEC_ENTRIES or greater, to maximize the chance of triggering the off-by-one write at the boundary of the local array or heap allocation.
3. Trigger the parse via an accessible interface: Write the crafted label to /proc/self/attr/apparmor/current (requires only a local unprivileged user account), invoke lsm_set_self_attr(2) with the crafted label, or write to the securityfs .access file (world-writable, no permission check required).
4. Trigger out-of-bounds write: The kernel's aa_label_strn_parse() calls vec_setup() allocating exactly len pointers, then calls aa_vec_unique() with VEC_FLAG_TERMINATE, which writes a null terminator one entry past the end of the buffer, corrupting adjacent kernel memory.
5. Achieve privilege escalation or DoS: Depending on what kernel memory is overwritten, the attacker may be able to corrupt kernel data structures to escalate privileges to root or cause a kernel panic (denial of service) (Red Hat Bugzilla, Github Advisory).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing AppArmor label parsing functions such as aa_label_strn_parse, aa_vec_unique, or vec_setup; unexpected AppArmor audit log entries for label change attempts from unprivileged processes.
• File System / Proc: Unusual or repeated writes to /proc/self/attr/apparmor/current or /proc/<pid>/attr/apparmor/current by non-privileged processes with crafted label strings containing many //& separators.
• Process Behavior: Unprivileged processes making repeated lsm_set_self_attr(2) syscalls with long, structured label arguments; unexpected privilege escalation of a previously unprivileged process.
• Network: Unusual outbound connections from a previously unprivileged process following AppArmor-related kernel log anomalies (may indicate post-exploitation activity).

Apply the upstream kernel patches that fix the buffer allocation in vec_setup() and DEFINE_VEC() to reserve an extra slot for the null terminator. Fixed versions are available in Linux kernel stable releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1 (Github Advisory). The specific fix commits are 9124e078ea22, 28069434aef6, 36bdd0b45ec3, and 9f1e40193eef. As a temporary workaround, restrict access to the securityfs .access file (currently mode 0666) through additional filesystem permissions or mount options, and limit write access to /proc/self/attr/apparmor/current where operationally feasible. Prioritize patching systems with AppArmor enabled and policy loaded, as those are the only systems affected (Red Hat Bugzilla).

Red Hat has tracked this vulnerability as high severity in their Bugzilla system and assigned it to their Product Security DevOps Team for response (Red Hat Bugzilla). The GitHub Advisory Database published the advisory on September 11, 2026, classifying it as High severity (Github Advisory). The vulnerability was also noted on Mastodon by The Hacker Wire and covered briefly on their vulnerability tracking page, indicating moderate community awareness. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.