CVE-2026-63827: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop
Summary
A use-after-free vulnerability (a bug where code tries to access memory that has already been freed) exists in the Linux kernel's AppArmor security module in the rawdata dedup loop of aa_replace_profiles(). The bug occurs because the code unconditionally tries to increment a reference counter on data structures that may have already been marked for deletion, triggering refcount hardening warnings and potential crashes.
Solution / Mitigation
Introduce a new function called aa_get_profile_loaddata_not0() that matches the existing _not0 convention used by aa_get_profile_not0(), and use it instead of aa_get_profile_loaddata() for the rawdata_list dedup lookup so that dying entries (those with reference count 0) are skipped. The patch was tested on x86_64 with Linux v7.1-rc5 in QEMU+KVM running Ubuntu 24.04, and the refcount_t warnings that appeared within seconds without the fix did not occur in a 60-second test run with the patch applied.
Vulnerability Details
EPSS: 0.0%
July 19, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-63827
First tracked: July 19, 2026 at 02:09 PM
Classified by LLM (prompt v3) · confidence: 95%