GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-63827 (GCVE-0-2026-63827)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:51
VLAI
Title
apparmor: fix use-after-free in rawdata dedup loop
Summary
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aa_loaddata, list membership does not hold a reference: profiles hold pcount, and when the last pcount drops, do_ploaddata_rmfs() is queued on a workqueue that takes ns->lock and removes the entry. Between dropping the last pcount and the workqueue running, an entry remains on the list with pcount == 0. aa_get_profile_loaddata() is an unconditional kref_get() on pcount, so when the dedup loop hits such an entry, refcount hardening reports refcount_t: addition on 0; use-after-free. inside aa_replace_profiles(), and the poisoned counter then trips "saturated" and "underflow" warnings on the subsequent uses of the same loaddata. Before commit a0b7091c4de4 ("apparmor: fix race on rawdata dereference") the dedup path used a get_unless_zero-style helper on a single counter, so the existing "if (tmp)" guard was meaningful. The split-refcount refactor introduced aa_get_profile_loaddata(), which has plain kref_get() semantics, and the guard quietly became a no-op. Introduce aa_get_profile_loaddata_not0(), matching the existing _not0 convention used by aa_get_profile_not0(), and use it for the rawdata_list dedup lookup so dying entries are skipped. Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu 24.04 + stress-ng 0.17.06: stress-ng --apparmor 1 --klog-check --timeout 60s Without this patch the three refcount_t warnings fire within a few seconds. With it the same 60 s run is clean. Coverage is a smoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN and CONFIG_PROVE_LOCKING would be welcome from anyone with the cycles.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3b8e77c7abab40e6de9ad9de730d77984a498840 , < 643221da57dbb1a8fd800610331cf1ec27969f71 (git)
Affected: d9d8560b9b7932f8cffc4c068c14289220900f79 , < b17f0c59cc1525765625cf07d0391b7f9c1ed7e5 (git)
Affected: 6b6ba87579c7e7c669e0bec91823e7fb693bc5df , < a7a2890028f16e5b0af0bb005d80fcb32559cca3 (git)
Affected: 6ef1f2926c41ab96952d9696d55a052f1b3a9418 , < 15fd83a1e42ede15070968806bb6c8b1a5170688 (git)
Affected: f9761add6d100962a23996cb68f3d6abdd4d1815 , < ce261a20b41db522e320a41bbf1292bf85af66df (git)
Affected: af782cc8871e3683ddd5a3cd2f7df526599863a9 , < c3ca2631073b2cef06824fd2bfc452ff7a1023de (git)
Affected: a0b7091c4de45a7325c8780e6934a894f92ac86b , < 5e34fa9f6f7cd688ae153fff13139a5cf2d42339 (git)
Affected: a0b7091c4de45a7325c8780e6934a894f92ac86b , < 6f060496d03e4dc560a40f73770bd08335cb7a27 (git)
Affected: 763e838adc3c7ec5a7df2990ce84cad951e42721 (git)
Affected: 5.10.253 , < 5.10.261 (semver)
Affected: 5.15.203 , < 5.15.212 (semver)
Affected: 6.1.169 , < 6.1.177 (semver)
Affected: 6.6.130 , < 6.6.144 (semver)
Affected: 6.12.77 , < 6.12.95 (semver)
Affected: 6.18.18 , < 6.18.38 (semver)
Affected: 6.19.8 , < 6.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.177 , ≤ 6.1.* (semver)
Unaffected: 6.6.144 , ≤ 6.6.* (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.38 , ≤ 6.18.* (semver)
Unaffected: 7.1.3 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/policy_unpack.h",
            "security/apparmor/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "643221da57dbb1a8fd800610331cf1ec27969f71",
              "status": "affected",
              "version": "3b8e77c7abab40e6de9ad9de730d77984a498840",
              "versionType": "git"
            },
            {
              "lessThan": "b17f0c59cc1525765625cf07d0391b7f9c1ed7e5",
              "status": "affected",
              "version": "d9d8560b9b7932f8cffc4c068c14289220900f79",
              "versionType": "git"
            },
            {
              "lessThan": "a7a2890028f16e5b0af0bb005d80fcb32559cca3",
              "status": "affected",
              "version": "6b6ba87579c7e7c669e0bec91823e7fb693bc5df",
              "versionType": "git"
            },
            {
              "lessThan": "15fd83a1e42ede15070968806bb6c8b1a5170688",
              "status": "affected",
              "version": "6ef1f2926c41ab96952d9696d55a052f1b3a9418",
              "versionType": "git"
            },
            {
              "lessThan": "ce261a20b41db522e320a41bbf1292bf85af66df",
              "status": "affected",
              "version": "f9761add6d100962a23996cb68f3d6abdd4d1815",
              "versionType": "git"
            },
            {
              "lessThan": "c3ca2631073b2cef06824fd2bfc452ff7a1023de",
              "status": "affected",
              "version": "af782cc8871e3683ddd5a3cd2f7df526599863a9",
              "versionType": "git"
            },
            {
              "lessThan": "5e34fa9f6f7cd688ae153fff13139a5cf2d42339",
              "status": "affected",
              "version": "a0b7091c4de45a7325c8780e6934a894f92ac86b",
              "versionType": "git"
            },
            {
              "lessThan": "6f060496d03e4dc560a40f73770bd08335cb7a27",
              "status": "affected",
              "version": "a0b7091c4de45a7325c8780e6934a894f92ac86b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "763e838adc3c7ec5a7df2990ce84cad951e42721",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.177",
              "status": "affected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.144",
              "status": "affected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.95",
              "status": "affected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.38",
              "status": "affected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/policy_unpack.h",
            "security/apparmor/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.253",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "6.1.169",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "6.6.130",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "6.12.77",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "6.18.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix use-after-free in rawdata dedup loop\n\naa_replace_profiles() walks ns-\u003erawdata_list to dedup the incoming\npolicy blob against entries already attached to existing profiles.\nPer the kernel-doc on struct aa_loaddata, list membership does not\nhold a reference: profiles hold pcount, and when the last pcount\ndrops, do_ploaddata_rmfs() is queued on a workqueue that takes\nns-\u003elock and removes the entry. Between dropping the last pcount\nand the workqueue running, an entry remains on the list with\npcount == 0.\n\naa_get_profile_loaddata() is an unconditional kref_get() on\npcount, so when the dedup loop hits such an entry, refcount\nhardening reports\n\n  refcount_t: addition on 0; use-after-free.\n\ninside aa_replace_profiles(), and the poisoned counter then\ntrips \"saturated\" and \"underflow\" warnings on the subsequent\nuses of the same loaddata.\n\nBefore commit a0b7091c4de4 (\"apparmor: fix race on rawdata\ndereference\") the dedup path used a get_unless_zero-style helper\non a single counter, so the existing \"if (tmp)\" guard was\nmeaningful. The split-refcount refactor introduced\naa_get_profile_loaddata(), which has plain kref_get() semantics,\nand the guard quietly became a no-op.\n\nIntroduce aa_get_profile_loaddata_not0(), matching the existing\n_not0 convention used by aa_get_profile_not0(), and use it for\nthe rawdata_list dedup lookup so dying entries are skipped.\n\nReproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu\n24.04 + stress-ng 0.17.06:\n\n  stress-ng --apparmor 1 --klog-check --timeout 60s\n\nWithout this patch the three refcount_t warnings fire within a\nfew seconds. With it the same 60 s run is clean. Coverage is a\nsmoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN\nand CONFIG_PROVE_LOCKING would be welcome from anyone with the\ncycles."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local write() to AppArmor policy management interfaces (.load/.replace) under securityfs/apparmorfs, not through any network-facing protocol.\nAC:L - An attacker with policy-admin capability can reliably win the race by concurrently loading/replacing and removing profiles with identical rawdata blobs, as demonstrated by stress-ng reproducing refcount UAF warnings within seconds.\nPR:L - Triggering aa_replace_profiles() requires CAP_MAC_ADMIN plus policy-view rights; on typical AppArmor deployments (e.g. Ubuntu) namespace-root in an unprivileged user namespace can obtain CAP_MAC_ADMIN via unprivileged_userns_apparmor_policy without init-namespace root.\nUI:N - Exploitation is driven entirely by the attacker\u0027s own policy load/replace/remove operations and does not require any action from another user or administrator.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security boundary, not a cross-VM or cross-security-authority escape.\nC:H - The vulnerability is a use-after-free on aa_loaddata profile refcounts; refcount hardening reports \"addition on 0; use-after-free\" and poisons the counter, creating a path to arbitrary kernel memory disclosure.\nI:H - UAF and refcount saturation/underflow on aa_loaddata enable heap corruption primitives that can be leveraged for arbitrary kernel writes and local privilege escalation.\nA:H - The bug reliably triggers refcount_t UAF warnings and corrupts subsequent refcount operations on the same loaddata, causing kernel instability and potential crash/panic under concurrent policy management."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:35.761Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/643221da57dbb1a8fd800610331cf1ec27969f71"
        },
        {
          "url": "https://git.kernel.org/stable/c/b17f0c59cc1525765625cf07d0391b7f9c1ed7e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7a2890028f16e5b0af0bb005d80fcb32559cca3"
        },
        {
          "url": "https://git.kernel.org/stable/c/15fd83a1e42ede15070968806bb6c8b1a5170688"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce261a20b41db522e320a41bbf1292bf85af66df"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3ca2631073b2cef06824fd2bfc452ff7a1023de"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e34fa9f6f7cd688ae153fff13139a5cf2d42339"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f060496d03e4dc560a40f73770bd08335cb7a27"
        }
      ],
      "title": "apparmor: fix use-after-free in rawdata dedup loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63827",
    "datePublished": "2026-07-19T12:02:22.083Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-17T04:51:35.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63827",
      "date": "2026-09-18",
      "epss": "0.00124",
      "percentile": "0.02465"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-14T17:59:26.000Z",
      "cve": "CVE-2026-63827",
      "id": "msrc_CVE-2026-63827",
      "initial_release_date": "2026-07-20T01:08:16.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "apparmor: fix use-after-free in rawdata dedup loop",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63827.json",
      "version": "7"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "security/apparmor/include/policy_unpack.h",
                  "security/apparmor/policy.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "643221da57dbb1a8fd800610331cf1ec27969f71",
                    "status": "affected",
                    "version": "3b8e77c7abab40e6de9ad9de730d77984a498840",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b17f0c59cc1525765625cf07d0391b7f9c1ed7e5",
                    "status": "affected",
                    "version": "d9d8560b9b7932f8cffc4c068c14289220900f79",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a7a2890028f16e5b0af0bb005d80fcb32559cca3",
                    "status": "affected",
                    "version": "6b6ba87579c7e7c669e0bec91823e7fb693bc5df",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "15fd83a1e42ede15070968806bb6c8b1a5170688",
                    "status": "affected",
                    "version": "6ef1f2926c41ab96952d9696d55a052f1b3a9418",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ce261a20b41db522e320a41bbf1292bf85af66df",
                    "status": "affected",
                    "version": "f9761add6d100962a23996cb68f3d6abdd4d1815",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c3ca2631073b2cef06824fd2bfc452ff7a1023de",
                    "status": "affected",
                    "version": "af782cc8871e3683ddd5a3cd2f7df526599863a9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5e34fa9f6f7cd688ae153fff13139a5cf2d42339",
                    "status": "affected",
                    "version": "a0b7091c4de45a7325c8780e6934a894f92ac86b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6f060496d03e4dc560a40f73770bd08335cb7a27",
                    "status": "affected",
                    "version": "a0b7091c4de45a7325c8780e6934a894f92ac86b",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "763e838adc3c7ec5a7df2990ce84cad951e42721",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.261",
                    "status": "affected",
                    "version": "5.10.253",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.212",
                    "status": "affected",
                    "version": "5.15.203",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.177",
                    "status": "affected",
                    "version": "6.1.169",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.144",
                    "status": "affected",
                    "version": "6.6.130",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.95",
                    "status": "affected",
                    "version": "6.12.77",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.38",
                    "status": "affected",
                    "version": "6.18.18",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.20",
                    "status": "affected",
                    "version": "6.19.8",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "security/apparmor/include/policy_unpack.h",
                  "security/apparmor/policy.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0"
                  },
                  {
                    "lessThan": "7.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.177",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.144",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.95",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.38",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix use-after-free in rawdata dedup loop\n\naa_replace_profiles() walks ns-\u003erawdata_list to dedup the incoming\npolicy blob against entries already attached to existing profiles.\nPer the kernel-doc on struct aa_loaddata, list membership does not\nhold a reference: profiles hold pcount, and when the last pcount\ndrops, do_ploaddata_rmfs() is queued on a workqueue that takes\nns-\u003elock and removes the entry. Between dropping the last pcount\nand the workqueue running, an entry remains on the list with\npcount == 0.\n\naa_get_profile_loaddata() is an unconditional kref_get() on\npcount, so when the dedup loop hits such an entry, refcount\nhardening reports\n\n  refcount_t: addition on 0; use-after-free.\n\ninside aa_replace_profiles(), and the poisoned counter then\ntrips \"saturated\" and \"underflow\" warnings on the subsequent\nuses of the same loaddata.\n\nBefore commit a0b7091c4de4 (\"apparmor: fix race on rawdata\ndereference\") the dedup path used a get_unless_zero-style helper\non a single counter, so the existing \"if (tmp)\" guard was\nmeaningful. The split-refcount refactor introduced\naa_get_profile_loaddata(), which has plain kref_get() semantics,\nand the guard quietly became a no-op.\n\nIntroduce aa_get_profile_loaddata_not0(), matching the existing\n_not0 convention used by aa_get_profile_not0(), and use it for\nthe rawdata_list dedup lookup so dying entries are skipped.\n\nReproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu\n24.04 + stress-ng 0.17.06:\n\n  stress-ng --apparmor 1 --klog-check --timeout 60s\n\nWithout this patch the three refcount_t warnings fire within a\nfew seconds. With it the same 60 s run is clean. Coverage is a\nsmoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN\nand CONFIG_PROVE_LOCKING would be welcome from anyone with the\ncycles."
          }
        ],
        "id": "CVE-2026-63827",
        "lastModified": "2026-08-17T05:17:20.337",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T12:16:55.960",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/15fd83a1e42ede15070968806bb6c8b1a5170688"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5e34fa9f6f7cd688ae153fff13139a5cf2d42339"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/643221da57dbb1a8fd800610331cf1ec27969f71"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6f060496d03e4dc560a40f73770bd08335cb7a27"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a7a2890028f16e5b0af0bb005d80fcb32559cca3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b17f0c59cc1525765625cf07d0391b7f9c1ed7e5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c3ca2631073b2cef06824fd2bfc452ff7a1023de"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ce261a20b41db522e320a41bbf1292bf85af66df"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-21T08:06:39+00:00",
      "cve": "CVE-2026-63827",
      "id": "CVE-2026-63827",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: apparmor: fix use-after-free in rawdata dedup loop",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63827.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:47:54Z",
      "cve": "CVE-2026-63827",
      "id": "CVE-2026-63827",
      "initial_release_date": "2026-07-19T17:34:37Z",
      "product_status:first_fixed": "106",
      "product_status:known_affected": "557",
      "product_status:known_not_affected": "164",
      "product_status:recommended": "256",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63827",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63827.json",
      "version": "19"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.