Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-63827

apparmor: fix use-after-free in rawdata dedup loop

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aa_loaddata, list membership does not hold a reference: profiles hold pcount, and when the last pcount drops, do_ploaddata_rmfs() is queued on a workqueue that takes ns->lock and removes the entry. Between dropping the last pcount and the workqueue running, an entry remains on the list with pcount == 0. aa_get_profile_loaddata() is an unconditional kref_get() on pcount, so when the dedup loop hits such an entry, refcount hardening reports refcount_t: addition on 0; use-after-free. inside aa_replace_profiles(), and the poisoned counter then trips "saturated" and "underflow" warnings on the subsequent uses of the same loaddata. Before commit a0b7091c4de4 ("apparmor: fix race on rawdata dereference") the dedup path used a get_unless_zero-style helper on a single counter, so the existing "if (tmp)" guard was meaningful. The split-refcount refactor introduced aa_get_profile_loaddata(), which has plain kref_get() semantics, and the guard quietly became a no-op. Introduce aa_get_profile_loaddata_not0(), matching the existing _not0 convention used by aa_get_profile_not0(), and use it for the rawdata_list dedup lookup so dying entries are skipped. Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu 24.04 + stress-ng 0.17.06: stress-ng --apparmor 1 --klog-check --timeout 60s Without this patch the three refcount_t warnings fire within a few seconds. With it the same 60 s run is clean. Coverage is a smoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN and CONFIG_PROVE_LOCKING would be welcome from anyone with the cycles.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 3b8e77c7abab40e6de9ad9de730d77984a498840 to < 643221da57dbb1a8fd800610331cf1ec27969f71affected
  • d9d8560b9b7932f8cffc4c068c14289220900f79 to < b17f0c59cc1525765625cf07d0391b7f9c1ed7e5affected
  • 6b6ba87579c7e7c669e0bec91823e7fb693bc5df to < a7a2890028f16e5b0af0bb005d80fcb32559cca3affected
  • 6ef1f2926c41ab96952d9696d55a052f1b3a9418 to < 15fd83a1e42ede15070968806bb6c8b1a5170688affected
  • f9761add6d100962a23996cb68f3d6abdd4d1815 to < ce261a20b41db522e320a41bbf1292bf85af66dfaffected
  • af782cc8871e3683ddd5a3cd2f7df526599863a9 to < c3ca2631073b2cef06824fd2bfc452ff7a1023deaffected
  • a0b7091c4de45a7325c8780e6934a894f92ac86b to < 5e34fa9f6f7cd688ae153fff13139a5cf2d42339affected
  • a0b7091c4de45a7325c8780e6934a894f92ac86b to < 6f060496d03e4dc560a40f73770bd08335cb7a27affected
  • 763e838adc3c7ec5a7df2990ce84cad951e42721affected
  • 5.10.253 to < 5.10.261affected
  • 5.15.203 to < 5.15.212affected
  • 6.1.169 to < 6.1.177affected
  • 6.6.130 to < 6.6.144affected
  • 6.12.77 to < 6.12.95affected
  • 6.18.18 to < 6.18.38affected
  • 6.19.8 to < 6.20affected

Linux Linux

Default version status: affected

  • 7.0affected
  • 0 to < 7.0unaffected
  • 5.10.261 to ≤ 5.10.*unaffected
  • 5.15.212 to ≤ 5.15.*unaffected
  • 6.1.177 to ≤ 6.1.*unaffected
  • 6.6.144 to ≤ 6.6.*unaffected
  • 6.12.95 to ≤ 6.12.*unaffected
  • 6.18.38 to ≤ 6.18.*unaffected
  • 7.1.3 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References