CVE-2026-63827: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63827 Overview

CVE-2026-63827 is a use-after-free vulnerability in the Linux kernel's AppArmor subsystem. The flaw resides in aa_replace_profiles(), which walks ns->rawdata_list to deduplicate incoming policy blobs against entries already attached to existing profiles. A race between the last pcount drop and the deferred do_ploaddata_rmfs() workqueue leaves entries on the list with pcount == 0. When the dedup loop reaches such an entry, aa_get_profile_loaddata() performs an unconditional kref_get(), triggering refcount_t: addition on 0; use-after-free.

Critical Impact
A local user with permission to load AppArmor policies can trigger a use-after-free in the kernel, leading to memory corruption and potential local privilege escalation.

Affected Products

Linux kernel versions containing commit a0b7091c4de4 ("apparmor: fix race on rawdata dereference") through v7.1-rc5
Distributions shipping vulnerable kernels, including Ubuntu 24.04 (reproduced in QEMU+KVM)
Any kernel build with AppArmor enabled (CONFIG_SECURITY_APPARMOR=y)

Discovery Timeline

2026-07-19 - CVE-2026-63827 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-63827

Vulnerability Analysis

The vulnerability is a use-after-free (UAF) affecting the AppArmor Linux Security Module. AppArmor stores loaded policy blobs in a per-namespace list, ns->rawdata_list. Per the kernel-doc on struct aa_loaddata, list membership itself does not hold a reference. Profiles hold pcount, and when the last pcount drops, do_ploaddata_rmfs() is queued on a workqueue that acquires ns->lock and removes the entry.

Between the last pcount decrement and the workqueue actually running, the entry remains reachable on the list with pcount == 0. Any concurrent policy replacement that walks the list to deduplicate the incoming blob can dereference this dying entry.

Root Cause

Before commit a0b7091c4de4 ("apparmor: fix race on rawdata dereference"), the dedup path used a get_unless_zero-style helper on a single counter. The if (tmp) guard in the caller was meaningful. The split-refcount refactor introduced aa_get_profile_loaddata(), which has plain kref_get() semantics. The existing guard silently became a no-op, allowing the code to increment a zeroed refcount.

Attack Vector

Exploitation requires local access with the ability to load AppArmor policies. The reporter reproduced the flaw on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu 24.04 using stress-ng --apparmor 1 --klog-check --timeout 60s. Within seconds, three refcount_t warnings fire: addition on 0; use-after-free, followed by saturated and underflow warnings on subsequent uses of the same loaddata. A crafted workload racing policy loads against policy removals can weaponize the poisoned counter into memory corruption.

The fix introduces aa_get_profile_loaddata_not0(), matching the existing _not0 convention used by aa_get_profile_not0(), and uses it in the rawdata_list dedup lookup so dying entries are skipped.

Detection Methods for CVE-2026-63827

Indicators of Compromise

Kernel log messages containing refcount_t: addition on 0; use-after-free originating from aa_replace_profiles
Subsequent refcount_t warnings reporting saturated or underflow on the same loaddata object
Unexpected kernel oops or panic traces referencing aa_get_profile_loaddata or ns->rawdata_list

Detection Strategies

Monitor dmesg and /var/log/kern.log for refcount_t warnings tied to AppArmor symbols
Enable CONFIG_KASAN, CONFIG_KCSAN, and CONFIG_PROVE_LOCKING on test kernels to surface the race deterministically
Audit apparmor_parser invocations and unprivileged processes attempting to write to /sys/kernel/security/apparmor/.load or .replace

Monitoring Recommendations

Alert on repeated AppArmor policy replace operations from non-administrative users or containers
Correlate kernel warnings with process ancestry to identify workloads that racing policy loads with removals
Forward kernel telemetry to a centralized logging pipeline for retention and cross-host correlation

How to Mitigate CVE-2026-63827

Immediate Actions Required

Apply the upstream kernel patches that introduce aa_get_profile_loaddata_not0() and use it in the rawdata_list dedup lookup
Rebuild or update to a kernel that includes the referenced stable commits, then reboot affected hosts
Restrict which users, containers, and services can load or replace AppArmor policies

Patch Information

The fix is available in the mainline and stable trees via the following commits: Kernel Git Commit 15fd83a, Kernel Git Commit 5e34fa9, Kernel Git Commit 643221d, Kernel Git Commit 6f06049, Kernel Git Commit a7a2890, Kernel Git Commit b17f0c5, Kernel Git Commit c3ca263, and Kernel Git Commit ce261a2. Verify your distribution vendor has backported these commits before deploying.

Workarounds

Disable dynamic policy replacement where feasible by freezing the AppArmor policy set after boot
Confine access to CAP_MAC_ADMIN so untrusted processes cannot invoke apparmor_parser --replace
Avoid running workloads that repeatedly load and unload AppArmor profiles on shared or multi-tenant hosts until patched

bash

# Confirm the running kernel and check for the fixed commits
uname -r
zgrep -i 'apparmor.*rawdata\|aa_get_profile_loaddata_not0' /proc/config.gz 2>/dev/null

# Restrict AppArmor policy loading to root only (default) and audit callers
auditctl -w /sys/kernel/security/apparmor/.load    -p wa -k apparmor_policy
auditctl -w /sys/kernel/security/apparmor/.replace -p wa -k apparmor_policy