[Bug 2169442] [NEW] Use-after-free in AppArmor prompting: audit_cache_work_function delayed work queued on freed memory → panic in __run_timers

Public bug reported: Kernel: 7.0.0-38-generic (also reproduced on 7.0.0-34-generic), Ubuntu 26.04 snapd: 2.77.1 with experimental.apparmor-prompting=true Hardware: Lenovo 21KV0018US (Meteor Lake), BIOS N48ET34W 1.21 Reproducible kernel panic within ~15-20s of launching the Thunderbird snap (157.0-2, rev 1279) when snapd AppArmor prompting is enabled. Happened 4 times in one evening. Setting experimental.apparmor-prompting=false makes it stop completely. Sequence: 1. Repeated: WARNING: kernel/workqueue.c:2351 at __queue_work.part.0+0x190/0x390 from delayed_work_timer_fn (timer softirq, idle CPU) 2. Oops: general protection fault, probably for non-canonical address 0xdead00000000012a, RIP: __run_timers+0x1e0/0x2c0 3. Kernel panic - not syncing: Fatal exception in interrupt A bpftrace kprobe on delayed_work_timer_fn caught the bad work items: in every case the delayed_work had func=audit_cache_work_function and work.entry.next == NULL (the memory was freed or zeroed). Each one was armed by snapd from this path: __queue_delayed_work knotif_update_from_uresp_perm+258 aa_listener_unotif_response+304 notify_user_response+288 listener_ioctl+699 __x64_sys_ioctl do_syscall_64 So when snapd responds to a prompt notification, the kernel queues audit_cache_work_function on a delayed_work whose containing object has already been freed (or was never initialized). The timer then fires on corrupted memory. Workaround: snap set system experimental.apparmor-prompting=false ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-38-generic 7.0.0-38.38 ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 Uname: Linux 7.0.0-38-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: tau 11619 F.... pipewire tau 11637 F.... wireplumber /dev/snd/seq: tau 11619 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Sat Oct 3 23:30:58 2026 InstallationDate: Installed on 2026-05-16 (141 days ago) InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) MachineType: LENOVO 21KV0018US ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-38-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash nvidia.NVreg_PreserveVideoMemoryAllocations=1 nvidia-drm.modeset=1 acpi.ec_no_wakeup=1 nmi_watchdog=0 snd_hda_intel.power_save=1 i915.enable_psr=0 crash_kexec_post_notifiers panic=10 crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 05/11/2026 dmi.bios.release: 1.21 dmi.bios.vendor: LENOVO dmi.bios.version: N48ET34W (1.21 ) dmi.board.asset.tag: Not Available dmi.board.name: 21KV0018US dmi.board.vendor: LENOVO dmi.board.version: SDK0T76530 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.15 dmi.modalias: dmi:bvnLENOVO:bvrN48ET34W(1.21):bd05/11/2026:br1.21:efr1.15:svnLENOVO:pn21KV0018US:pvrThinkPadP1Gen7:rvnLENOVO:rn21KV0018US:rvrSDK0T76530WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21KV_BU_Think_FM_ThinkPadP1Gen7:pfaThinkPadP1Gen7: dmi.product.family: ThinkPad P1 Gen 7 dmi.product.name: 21KV0018US dmi.product.sku: LENOVO_MT_21KV_BU_Think_FM_ThinkPad P1 Gen 7 dmi.product.version: ThinkPad P1 Gen 7 dmi.sys.vendor: LENOVO ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute wayland-session -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2169442 Title: Use-after-free in AppArmor prompting: audit_cache_work_function delayed work queued on freed memory → panic in __run_timers Status in linux package in Ubuntu: New Bug description: Kernel: 7.0.0-38-generic (also reproduced on 7.0.0-34-generic), Ubuntu 26.04 snapd: 2.77.1 with experimental.apparmor-prompting=true Hardware: Lenovo 21KV0018US (Meteor Lake), BIOS N48ET34W 1.21 Reproducible kernel panic within ~15-20s of launching the Thunderbird snap (157.0-2, rev 1279) when snapd AppArmor prompting is enabled. Happened 4 times in one evening. Setting experimental.apparmor-prompting=false makes it stop completely. Sequence: 1. Repeated: WARNING: kernel/workqueue.c:2351 at __queue_work.part.0+0x190/0x390 from delayed_work_timer_fn (timer softirq, idle CPU) 2. Oops: general protection fault, probably for non-canonical address 0xdead00000000012a, RIP: __run_timers+0x1e0/0x2c0 3. Kernel panic - not syncing: Fatal exception in interrupt A bpftrace kprobe on delayed_work_timer_fn caught the bad work items: in every case the delayed_work had func=audit_cache_work_function and work.entry.next == NULL (the memory was freed or zeroed). Each one was armed by snapd from this path: __queue_delayed_work knotif_update_from_uresp_perm+258 aa_listener_unotif_response+304 notify_user_response+288 listener_ioctl+699 __x64_sys_ioctl do_syscall_64 So when snapd responds to a prompt notification, the kernel queues audit_cache_work_function on a delayed_work whose containing object has already been freed (or was never initialized). The timer then fires on corrupted memory. Workaround: snap set system experimental.apparmor-prompting=false ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-38-generic 7.0.0-38.38 ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 Uname: Linux 7.0.0-38-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: tau 11619 F.... pipewire tau 11637 F.... wireplumber /dev/snd/seq: tau 11619 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Sat Oct 3 23:30:58 2026 InstallationDate: Installed on 2026-05-16 (141 days ago) InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) MachineType: LENOVO 21KV0018US ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-38-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash nvidia.NVreg_PreserveVideoMemoryAllocations=1 nvidia-drm.modeset=1 acpi.ec_no_wakeup=1 nmi_watchdog=0 snd_hda_intel.power_save=1 i915.enable_psr=0 crash_kexec_post_notifiers panic=10 crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 05/11/2026 dmi.bios.release: 1.21 dmi.bios.vendor: LENOVO dmi.bios.version: N48ET34W (1.21 ) dmi.board.asset.tag: Not Available dmi.board.name: 21KV0018US dmi.board.vendor: LENOVO dmi.board.version: SDK0T76530 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.15 dmi.modalias: dmi:bvnLENOVO:bvrN48ET34W(1.21):bd05/11/2026:br1.21:efr1.15:svnLENOVO:pn21KV0018US:pvrThinkPadP1Gen7:rvnLENOVO:rn21KV0018US:rvrSDK0T76530WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21KV_BU_Think_FM_ThinkPadP1Gen7:pfaThinkPadP1Gen7: dmi.product.family: ThinkPad P1 Gen 7 dmi.product.name: 21KV0018US dmi.product.sku: LENOVO_MT_21KV_BU_Think_FM_ThinkPad P1 Gen 7 dmi.product.version: ThinkPad P1 Gen 7 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169442/+subscriptions