oss-security - Multiple vulnerabilities in AppArmor

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260312212345.GA2728@localhost.localdomain>
Date: Thu, 12 Mar 2026 21:23:56 +0000
From: Qualys Security Advisory <qsa@...lys.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
CC: John Johansen <john.johansen@...onical.com>
Subject: Multiple vulnerabilities in AppArmor

Hi all,

We will soon publish an advisory about multiple vulnerabilities in
AppArmor, but we first wanted to give an explanation and an apology.

We have been working on this for several months now, together with
Canonical's AppArmor developers (including AppArmor's maintainer, cc'd).
Once the patches were ready we contacted the Linux kernel security team,
and later the linux-distros list.

Unfortunately, problems were then identified with one of the patches,
which prevented them from being merged upstream and eventually resulted
in the exceedance of the linux-distros list's maximum 14-day embargo. We
sincerely apologize for this. The patches have now been merged upstream
(just a few hours after the maximum 14-day embargo).

Although contacting the linux-distros list has been clearly beneficial
(they have thoroughly reviewed and tested the patches, and were able to
prepare their kernel updates beforehand), we have reached the conclusion
that it has become increasingly difficult to coordinate the disclosure
of kernel vulnerabilities with both groups (the Linux kernel security
team and the linux-distros list), because they have very different
policies. From now on, we will coordinate the disclosure of kernel
vulnerabilities with the Linux kernel security team only. We also
apologize in advance for this.

Finally, we want to thank everyone involved in this release for their
hard work: Canonical's AppArmor developers, the Linux kernel security
team, the linux-distros list; the complete Acknowledgments and Timeline
will be available in the advisory.

Thank you very much for your time and understanding! With best regards,

-- 
the Qualys Security Advisory team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.