CVE-2026-63827

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix use-after-free in rawdata dedup loop

aa_replace_profiles() walks ns->rawdata_list to dedup the incoming

policy blob against entries already attached to existing profiles.

Per the kernel-doc on struct aa_loaddata, list membership does not

hold a reference: profiles hold pcount, and when the last pcount

drops, do_ploaddata_rmfs() is queued on a workqueue that takes

ns->lock and removes the entry. Between dropping the last pcount

and the workqueue running, an entry remains on the list with

pcount == 0.

aa_get_profile_loaddata() is an unconditional kref_get() on

pcount, so when the dedup loop hits such an entry, refcount

hardening reports

refcount_t: addition on 0; use-after-free.

inside aa_replace_profiles(), and the poisoned counter then

trips "saturated" and "underflow" warnings on the subsequent

uses of the same loaddata.

Before commit a0b7091c4de4 ("apparmor: fix race on rawdata

dereference") the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References