In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aa_replace_profiles() walks… (CVE-2026-63827)
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aa_loaddata, list membership does not hold a reference: profiles hold pcount, and when the last pcount drops, do_ploaddata_rmfs() is queued on a workqueue that takes ns->lock and removes the entry. Between dropping the last pcount and the workqueue running, an entry remains on the list with pcount == 0. aa_get_profile_loaddata() is an unconditional kref_get() on pcount, so when the dedup loop hits such an entry, refcount hardening reports refcount_t: addition on 0; use-after-free. inside aa_replace_profiles(), and the poisoned counter then trips "saturated" and "underflow" warnings on the subsequent uses of the same loaddata. Before commit a0b7091c4de4 ("apparmor: fix race on rawdata dereference") the dedup path used a get_unless_zero-style helper on a single counter, so the existing "if (tmp)" guard was meaningful. The split-refcount refactor introduced aa_get_profile_loaddata(), which has plain kref_get() semantics, and the guard quietly became a no-op. Introduce aa_get_profile_loaddata_not0(), matching the existing _not0 convention used by aa_get_profile_not0(), and use it for the rawdata_list dedup lookup so dying entries are skipped. Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu 24.04 + stress-ng 0.17.06: stress-ng --apparmor 1 --klog-check --timeout 60s Without this patch the three refcount_t warnings fire within a few seconds. With it the same 60 s run is clean. Coverage is a smoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN and CONFIG_PROVE_LOCKING would be welcome from anyone with the cycles.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's AppArmor subsystem involves a use-after-free condition in the rawdata deduplication loop within aa_replace_profiles(). The function walks through ns->rawdata_list to deduplicate incoming policy blobs against existing profiles. Due to the way reference counts (pcount) are managed, entries with a zero reference count can remain on the list briefly before being removed by a workqueue. The existing aa_get_profile_loaddata() function unconditionally increments the reference count, causing refcount hardening to detect an addition on zero, which is a use-after-free. The patch introduces aa_get_profile_loaddata_not0(), which only increments reference counts if they are non-zero, preventing use-after-free errors during deduplication.
Potential Impact
This vulnerability can lead to use-after-free conditions in the kernel's AppArmor policy management, which may cause kernel warnings and potentially undefined behavior or crashes. No known exploits in the wild have been reported. The impact is limited to the kernel's AppArmor subsystem during policy blob deduplication.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability by introducing a safer reference count increment function that skips entries with zero reference counts. Users should apply the official kernel update containing commit a0b7091c4de4 or later to remediate this issue. Patch status is confirmed resolved in the kernel source. No additional mitigation steps are required beyond applying the official fix.
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aa_replace_profiles() walks… (CVE-2026-63827)
Description
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aa_loaddata, list membership does not hold a reference: profiles hold pcount, and when the last pcount drops, do_ploaddata_rmfs() is queued on a workqueue that takes ns->lock and removes the entry. Between dropping the last pcount and the workqueue running, an entry remains on the list with pcount == 0. aa_get_profile_loaddata() is an unconditional kref_get() on pcount, so when the dedup loop hits such an entry, refcount hardening reports refcount_t: addition on 0; use-after-free. inside aa_replace_profiles(), and the poisoned counter then trips "saturated" and "underflow" warnings on the subsequent uses of the same loaddata. Before commit a0b7091c4de4 ("apparmor: fix race on rawdata dereference") the dedup path used a get_unless_zero-style helper on a single counter, so the existing "if (tmp)" guard was meaningful. The split-refcount refactor introduced aa_get_profile_loaddata(), which has plain kref_get() semantics, and the guard quietly became a no-op. Introduce aa_get_profile_loaddata_not0(), matching the existing _not0 convention used by aa_get_profile_not0(), and use it for the rawdata_list dedup lookup so dying entries are skipped. Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu 24.04 + stress-ng 0.17.06: stress-ng --apparmor 1 --klog-check --timeout 60s Without this patch the three refcount_t warnings fire within a few seconds. With it the same 60 s run is clean. Coverage is a smoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN and CONFIG_PROVE_LOCKING would be welcome from anyone with the cycles.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's AppArmor subsystem involves a use-after-free condition in the rawdata deduplication loop within aa_replace_profiles(). The function walks through ns->rawdata_list to deduplicate incoming policy blobs against existing profiles. Due to the way reference counts (pcount) are managed, entries with a zero reference count can remain on the list briefly before being removed by a workqueue. The existing aa_get_profile_loaddata() function unconditionally increments the reference count, causing refcount hardening to detect an addition on zero, which is a use-after-free. The patch introduces aa_get_profile_loaddata_not0(), which only increments reference counts if they are non-zero, preventing use-after-free errors during deduplication.
Potential Impact
This vulnerability can lead to use-after-free conditions in the kernel's AppArmor policy management, which may cause kernel warnings and potentially undefined behavior or crashes. No known exploits in the wild have been reported. The impact is limited to the kernel's AppArmor subsystem during policy blob deduplication.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability by introducing a safer reference count increment function that skips entries with zero reference counts. Users should apply the official kernel update containing commit a0b7091c4de4 or later to remediate this issue. Patch status is confirmed resolved in the kernel source. No additional mitigation steps are required beyond applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gpp3-g5wp-8xhw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63827"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27ad2a4a8d5989131254
Added to database: 07/19/2026, 19:38:21 UTC
Last enriched: 07/19/2026, 20:18:11 UTC
Last updated: 07/20/2026, 19:41:22 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.