Re: [PATCH] apparmor: fix cred UAF caused by begin_current_label_crit_section()

[Jann Horn]

On Tue, Jul 14, 2026 at 5:39 PM Jann Horn <jannh@xxxxxxxxxx> wrote:
> AppArmor's begin_current_label_crit_section() is a scary function called
> from lots of LSM hooks (in particular VFS/socket-related ones) that checks
> if the label referenced by the current creds is marked FLAG_STALE, and if
> so, attempts to use aa_replace_current_label() to replace the creds with an
> updated version that uses a new label.

ping, I've seen no activity on this fix since posting it