PT-2026-61143 · Linux · Linux Kernel

CVE-2026-63827 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.1-rc5

Description A use-after-free issue exists in the AppArmor module of the Linux kernel. The aa replace profiles() function iterates through the ns->rawdata list to deduplicate incoming policy blobs against existing profiles. A race condition occurs because list membership does not hold a reference; when the last reference count (pcount) drops to zero, the entry is queued for removal via do ploaddata rmfs(). If the deduplication loop accesses an entry after the reference count has dropped to zero but before the removal workqueue has executed, the aa get profile loaddata() function performs an unconditional kref get(), leading to a use-after-free condition.

Recommendations Update the Linux kernel to a version where the aa get profile loaddata not0() function is implemented and used within aa replace profiles() to ensure entries with a zero reference count are skipped during the deduplication lookup.

Fix

Related Identifiers

CVE-2026-63827

Affected Products

Linux Kernel

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-63827 · Security Note
• https://git.kernel.org/stable/c/a7a2890028f16e5b0af0bb005d80fcb32559cca3 · Note
• https://git.kernel.org/stable/c/15fd83a1e42ede15070968806bb6c8b1a5170688 · Note
• https://git.kernel.org/stable/c/5e34fa9f6f7cd688ae153fff13139a5cf2d42339 · Note
• https://git.kernel.org/stable/c/c3ca2631073b2cef06824fd2bfc452ff7a1023de · Note
• https://git.kernel.org/stable/c/ce261a20b41db522e320a41bbf1292bf85af66df · Note
• https://twitter.com/VulmonFeeds/status/2078856173512446203 · Twitter Post
• https://git.kernel.org/stable/c/6f060496d03e4dc560a40f73770bd08335cb7a27 · Note