)]}'
{
  "commit": "ac989c5f0a2bac71c142be4c001a14684195c0bb",
  "tree": "2ed67e1082a872c399653963a9cd43ff62faa984",
  "parents": [
    "70d7e379f56b5c17fdec2c93942b9392ac36b19a"
  ],
  "author": {
    "name": "Massimiliano Pellizzer",
    "email": "massimiliano.pellizzer@canonical.com",
    "time": "Tue Jan 20 15:24:04 2026 +0100"
  },
  "committer": {
    "name": "Robert Kolchmeyer",
    "email": "rkolchmeyer@google.com",
    "time": "Fri Mar 13 13:34:30 2026 -0700"
  },
  "message": "apparmor: fix memory leak in verify_header\n\ncommit e38c55d9f834e5b848bfed0f5c586aaf45acb825 upstream.\n\nThe function sets `*ns \u003d NULL` on every call, leaking the namespace\nstring allocated in previous iterations when multiple profiles are\nunpacked. This also breaks namespace consistency checking since *ns\nis always NULL when the comparison is made.\n\nRemove the incorrect assignment.\nThe caller (aa_unpack) initializes *ns to NULL once before the loop,\nwhich is sufficient.\n\nBUG\u003dNone\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed the \"CrackArmor\" vulnerability in the Linux kernel.\n\ncos-patch: security-high\nFixes: dd51c8485763 (\"apparmor: provide base for multiple profiles to be replaced at once\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nChange-Id: I9abac5156dafbf9f8930cbb3617b9a54503e531b\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 786e2c2a87d9c505f33321d1fd23a176aa8ddeb1)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/137842\nReviewed-by: He Gao \u003chegao@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e1a9f4413e20b098a990ba054c2697c307f44aa8",
      "old_mode": 33188,
      "old_path": "security/apparmor/policy_unpack.c",
      "new_id": "e3ec7451d31e8d27e99bfcddc1dccf79b7548c15",
      "new_mode": 33188,
      "new_path": "security/apparmor/policy_unpack.c"
    }
  ]
}