[PATCH] apparmor: fix cred UAF caused by begin_current_label_crit_section()

[Jann Horn]

On Thu, Aug 6, 2026 at 2:02 AM John Johansen
<john.johansen at canonical.com> wrote:
> Q. What do you think about making the callback_head part of the apparmor
> security task blob. It would increase its size, but allow us to drop
> the alloc/free. Generally profile is generally something that is relatively
> rare, but when it does happen, its is quite common to have all the profiles
> being updated, so a thunder herd type problem.

It would waste a little bit of memory, and I'm not convinced that the
thundering herd would be an issue since allocation would only happen
when a task is running, and the allocation would go away at the end of
the syscall...

But yeah, I think that would make things simpler and avoid touching
task_work infrastructure, so I'll rework this.