Public bug reported:
Kernel: 7.0.0-38-generic (also reproduced on 7.0.0-34-generic), Ubuntu 26.04
snapd: 2.77.1 with experimental.apparmor-prompting=true
Hardware: Lenovo 21KV0018US (Meteor Lake), BIOS N48ET34W 1.21
Reproducible kernel panic within ~15-20s of launching the Thunderbird snap
(157.0-2, rev 1279) when snapd AppArmor prompting is enabled. Happened 4 times
in one evening. Setting experimental.apparmor-prompting=false makes it stop
completely.
Sequence:
1. Repeated: WARNING: kernel/workqueue.c:2351 at __queue_work.part.0+0x190/0x390
from delayed_work_timer_fn (timer softirq, idle CPU)
2. Oops: general protection fault, probably for non-canonical address
0xdead00000000012a, RIP: __run_timers+0x1e0/0x2c0
3. Kernel panic - not syncing: Fatal exception in interrupt
A bpftrace kprobe on delayed_work_timer_fn caught the bad work items: in every
case
the delayed_work had func=audit_cache_work_function and work.entry.next == NULL
(the memory was freed or zeroed). Each one was armed by snapd from this path:
__queue_delayed_work
knotif_update_from_uresp_perm+258
aa_listener_unotif_response+304
notify_user_response+288
listener_ioctl+699
__x64_sys_ioctl
do_syscall_64
So when snapd responds to a prompt notification, the kernel queues
audit_cache_work_function on a delayed_work whose containing object has already
been freed (or was never initialized). The timer then fires on corrupted memory.
Workaround: snap set system experimental.apparmor-prompting=false
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-38-generic 7.0.0-38.38
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: tau 11619 F.... pipewire
tau 11637 F.... wireplumber
/dev/snd/seq: tau 11619 F.... pipewire
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Sat Oct 3 23:30:58 2026
InstallationDate: Installed on 2026-05-16 (141 days ago)
InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1)
MachineType: LENOVO 21KV0018US
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-38-generic
root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash
nvidia.NVreg_PreserveVideoMemoryAllocations=1 nvidia-drm.modeset=1
acpi.ec_no_wakeup=1 nmi_watchdog=0 snd_hda_intel.power_save=1 i915.enable_psr=0
crash_kexec_post_notifiers panic=10
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No
PulseAudio daemon running, or not running as session daemon.
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 05/11/2026
dmi.bios.release: 1.21
dmi.bios.vendor: LENOVO
dmi.bios.version: N48ET34W (1.21 )
dmi.board.asset.tag: Not Available
dmi.board.name: 21KV0018US
dmi.board.vendor: LENOVO
dmi.board.version: SDK0T76530 WIN
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: None
dmi.ec.firmware.release: 1.15
dmi.modalias:
dmi:bvnLENOVO:bvrN48ET34W(1.21):bd05/11/2026:br1.21:efr1.15:svnLENOVO:pn21KV0018US:pvrThinkPadP1Gen7:rvnLENOVO:rn21KV0018US:rvrSDK0T76530WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21KV_BU_Think_FM_ThinkPadP1Gen7:pfaThinkPadP1Gen7:
dmi.product.family: ThinkPad P1 Gen 7
dmi.product.name: 21KV0018US
dmi.product.sku: LENOVO_MT_21KV_BU_Think_FM_ThinkPad P1 Gen 7
dmi.product.version: ThinkPad P1 Gen 7
dmi.sys.vendor: LENOVO
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169442
Title:
Use-after-free in AppArmor prompting: audit_cache_work_function
delayed work queued on freed memory → panic in __run_timers
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169442/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
