Linux Kernel Reference Count Leak Vulnerability in AppArmor's aa_pivotroot() Function

A reference count leak vulnerability has been identified in the Linux kernel's AppArmor subsystem, specifically within the aa_pivotroot() function. The issue arises when aa_replace_current_label() successfully returns, as the function fails to decrement the reference count of the 'target' variable. This oversight occurs because the reference count is initially increased by build_pivotroot(), leading to a memory leak. The vulnerability has been addressed by ensuring that the reference count of 'target' is properly decreased in the relevant execution path.

Impact

Exploitation of this vulnerability could lead to a reference count leak, potentially causing memory management issues such as use-after-free vulnerabilities.