CVE-2026-63827
Received Received - Intake

Use-After-Free in Linux Kernel AppArmor

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aa_loaddata, list membership does not hold a reference: profiles hold pcount, and when the last pcount drops, do_ploaddata_rmfs() is queued on a workqueue that takes ns->lock and removes the entry. Between dropping the last pcount and the workqueue running, an entry remains on the list with pcount == 0. aa_get_profile_loaddata() is an unconditional kref_get() on pcount, so when the dedup loop hits such an entry, refcount hardening reports refcount_t: addition on 0; use-after-free. inside aa_replace_profiles(), and the poisoned counter then trips "saturated" and "underflow" warnings on the subsequent uses of the same loaddata. Before commit a0b7091c4de4 ("apparmor: fix race on rawdata dereference") the dedup path used a get_unless_zero-style helper on a single counter, so the existing "if (tmp)" guard was meaningful. The split-refcount refactor introduced aa_get_profile_loaddata(), which has plain kref_get() semantics, and the guard quietly became a no-op. Introduce aa_get_profile_loaddata_not0(), matching the existing _not0 convention used by aa_get_profile_not0(), and use it for the rawdata_list dedup lookup so dying entries are skipped. Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu 24.04 + stress-ng 0.17.06: stress-ng --apparmor 1 --klog-check --timeout 60s Without this patch the three refcount_t warnings fire within a few seconds. With it the same 60 s run is clean. Coverage is a smoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN and CONFIG_PROVE_LOCKING would be welcome from anyone with the cycles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63827
EUVD
EUVD-2026-45493

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apparmor apparmor *
linux linux_kernel 7.1-rc5
stress-ng stress-ng 0.17.06
linux linux_kernel From 7.1-rc5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's AppArmor module. It occurs when aa_replace_profiles() tries to deduplicate policy blobs in a list where entries may have a zero reference count. The function aa_get_profile_loaddata() unconditionally increments the reference count, leading to a use-after-free when the entry is already being freed. This causes refcount_t warnings and potential system instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's AppArmor module and may not have direct network detection methods. Monitor kernel logs for refcount_t warnings related to AppArmor. Use commands like 'dmesg | grep -i refcount' or 'journalctl -k | grep -i refcount' to check for underflow or saturation warnings.

Impact Analysis

This vulnerability can cause system crashes or instability due to memory corruption. Attackers could exploit it to execute arbitrary code or escalate privileges. Systems running affected Linux kernels with AppArmor enabled are at risk, especially under heavy load or with stress tests.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's AppArmor module, which could lead to memory corruption or crashes. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy controls rather than kernel memory management.

Mitigation Strategies

Apply the kernel patch that fixes the use-after-free issue in AppArmor's rawdata dedup loop. Update to a patched kernel version. If immediate patching is not possible, consider disabling AppArmor temporarily as a workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63827. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart