apparmor: fix use-after-free in rawdata dedup loop

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-63827
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-19 12:16:55 UTC
Updated2026-07-20 15:16:49 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aa_loaddata, list membership does not hold a reference: profiles hold pcount, and when the last pcount drops, do_ploaddata_rmfs() is queued on a workqueue that takes ns->lock and removes the entry. Between dropping the last pcount and the workqueue running, an entry remains on the list with pcount == 0. aa_get_profile_loaddata() is an unconditional kref_get() on pcount, so when the dedup loop hits such an entry, refcount hardening reports refcount_t: addition on 0; use-after-free. inside aa_replace_profiles(), and the poisoned counter then trips "saturated" and "underflow" warnings on the subsequent uses of the same loaddata. Before commit a0b7091c4de4 ("apparmor: fix race on rawdata dereference") the dedup path used a get_unless_zero-style helper on a single counter, so the existing "if (tmp)" guard was meaningful. The split-refcount refactor introduced aa_get_profile_loaddata(), which has plain kref_get() semantics, and the guard quietly became a no-op. Introduce aa_get_profile_loaddata_not0(), matching the existing _not0 convention used by aa_get_profile_not0(), and use it for the rawdata_list dedup lookup so dying entries are skipped. Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu 24.04 + stress-ng 0.17.06: stress-ng --apparmor 1 --klog-check --timeout 60s Without this patch the three refcount_t warnings fire within a few seconds. With it the same 60 s run is clean. Coverage is a smoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN and CONFIG_PROVE_LOCKING would be welcome from anyone with the cycles.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001610000 probability, percentile 0.057130000 (date 2026-07-20)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 6b6ba87579c7e7c669e0bec91823e7fb693bc5df a7a2890028f16e5b0af0bb005d80fcb32559cca3 git Not specified
CNA Linux Linux affected 6ef1f2926c41ab96952d9696d55a052f1b3a9418 15fd83a1e42ede15070968806bb6c8b1a5170688 git Not specified
CNA Linux Linux affected f9761add6d100962a23996cb68f3d6abdd4d1815 ce261a20b41db522e320a41bbf1292bf85af66df git Not specified
CNA Linux Linux affected af782cc8871e3683ddd5a3cd2f7df526599863a9 c3ca2631073b2cef06824fd2bfc452ff7a1023de git Not specified
CNA Linux Linux affected a0b7091c4de45a7325c8780e6934a894f92ac86b 5e34fa9f6f7cd688ae153fff13139a5cf2d42339 git Not specified
CNA Linux Linux affected a0b7091c4de45a7325c8780e6934a894f92ac86b 6f060496d03e4dc560a40f73770bd08335cb7a27 git Not specified
CNA Linux Linux affected 3b8e77c7abab40e6de9ad9de730d77984a498840 git Not specified
CNA Linux Linux affected d9d8560b9b7932f8cffc4c068c14289220900f79 git Not specified
CNA Linux Linux affected 763e838adc3c7ec5a7df2990ce84cad951e42721 git Not specified
CNA Linux Linux affected 6.1.169 6.1.177 semver Not specified
CNA Linux Linux affected 6.6.130 6.6.144 semver Not specified
CNA Linux Linux affected 6.12.77 6.12.95 semver Not specified
CNA Linux Linux affected 6.18.18 6.18.38 semver Not specified
CNA Linux Linux affected 5.10.253 5.11 semver Not specified
CNA Linux Linux affected 5.15.203 5.16 semver Not specified
CNA Linux Linux affected 6.19.8 6.20 semver Not specified
CNA Linux Linux affected 7.0 Not specified
CNA Linux Linux unaffected 7.0 semver Not specified
CNA Linux Linux unaffected 6.1.177 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.144 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.95 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.38 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.3 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/c3ca2631073b2cef06824fd2bfc452ff7a1023de 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6f060496d03e4dc560a40f73770bd08335cb7a27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ce261a20b41db522e320a41bbf1292bf85af66df 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/15fd83a1e42ede15070968806bb6c8b1a5170688 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5e34fa9f6f7cd688ae153fff13139a5cf2d42339 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a7a2890028f16e5b0af0bb005d80fcb32559cca3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report