CVE-2026-80619: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80619 Overview

CVE-2026-80619 is a use-after-free (UAF) vulnerability in the Linux kernel's AppArmor subsystem. The flaw resides in the aa_replace_profiles function, which accesses udata->size after calling aa_put_loaddata(udata). Dropping the reference before reading the field can result in access to freed memory. The upstream fix saves the size to a local variable before releasing the reference.

A local attacker with the ability to load AppArmor profiles could trigger this condition to corrupt kernel memory. Successful exploitation impacts confidentiality, integrity, and availability of the affected system.

Critical Impact
Local exploitation of this UAF in the AppArmor profile replacement path can lead to kernel memory corruption and potential privilege escalation on affected Linux systems.

Affected Products

Linux kernel (AppArmor Linux Security Module)
Distributions shipping vulnerable stable kernel branches referenced by upstream commits
Systems where AppArmor is enabled and profile management is exposed to local users

Discovery Timeline

2026-08-28 - CVE-2026-80619 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80619

Vulnerability Analysis

The vulnerability lives in aa_replace_profiles, the AppArmor routine responsible for atomically swapping in new security profiles. The function receives a udata structure that wraps the profile load data supplied from userspace. During cleanup, the code calls aa_put_loaddata(udata) to drop its reference on the object. If this call releases the final reference, the underlying allocation is freed. The function then reads udata->size, dereferencing memory that has already been returned to the allocator.

An attacker with permission to load or replace AppArmor profiles can influence the timing and content of allocations that reuse the freed slab object. This creates a window to control kernel memory state observed by the subsequent read.

Root Cause

The root cause is a lifetime error: an object attribute is read after its owning reference has been dropped. The corrected code saves udata->size into a local variable before invoking aa_put_loaddata(udata), ensuring the value is captured while the allocation is still valid. This is a classic use-after-free pattern [CWE-416] in reference-counted kernel structures.

Attack Vector

Exploitation requires local access and the privileges needed to submit AppArmor profile data through the apparmorfs interface. The attack vector is local with low complexity and low privileges required, no user interaction, and unchanged scope. Container escape scenarios are relevant where workloads are permitted to manage AppArmor profiles.

No public proof-of-concept exploit is currently available. The vulnerability mechanism is documented in the upstream stable commits, including Kernel Git Commit 57b1bd4 and Kernel Git Commit dd5f120.

Detection Methods for CVE-2026-80619

Indicators of Compromise

Unexpected kernel oops, KASAN reports, or panics referencing aa_replace_profiles or aa_put_loaddata in dmesg and /var/log/kern.log.
Unusual write activity to /sys/kernel/security/apparmor/.replace or .load by non-administrative processes.
Local processes repeatedly invoking apparmor_parser or issuing raw writes to apparmorfs outside of normal package or configuration management workflows.

Detection Strategies

Enable KASAN on test kernels to catch UAF conditions in the AppArmor path during pre-production validation.
Audit execve telemetry for invocations of apparmor_parser originating from unprivileged users, containers, or unexpected parent processes.
Correlate kernel ring buffer messages tagged with apparmor against sudden process termination or capability changes on the same host.

Monitoring Recommendations

Forward auditd events for SECCOMP, AVC, and syscall writes targeting /sys/kernel/security/apparmor/* into a centralized SIEM for baselining.
Track kernel version and patch level inventory across Linux fleets to identify hosts still running vulnerable stable branches.
Alert on any container workload attempting to write AppArmor profile data, which typically indicates policy misconfiguration or attempted escape.

How to Mitigate CVE-2026-80619

Immediate Actions Required

Apply the upstream stable kernel patches from your distribution vendor as soon as builds are available.
Restrict CAP_MAC_ADMIN to trusted administrative processes, since loading and replacing AppArmor profiles requires this capability.
Prevent unprivileged containers from mounting or writing to apparmorfs by enforcing strict seccomp and namespace policies.

Patch Information

Upstream fixes are available across multiple stable trees. The corrected code stores udata->size in a local variable prior to calling aa_put_loaddata(udata). Review and apply the changes referenced in Kernel Git Commit 5cba148, Kernel Git Commit 7b42f95, Kernel Git Commit 9d37dc6, Kernel Git Commit 9d8e47c, Kernel Git Commit c0f3a3f, and Kernel Git Commit c44de08. Distribution-specific advisories should be tracked for backported builds.

Workarounds

Where patching is not immediately possible, limit which users and services can invoke apparmor_parser and write to apparmorfs.
Disable AppArmor profile hot-replacement in environments where profiles are managed exclusively through immutable images or configuration management.
Harden container runtimes to block CAP_MAC_ADMIN inside workloads and enforce read-only mounts of security filesystems.

bash

# Verify kernel version and AppArmor status
uname -r
aa-status

# Restrict access to AppArmor control files (example)
chmod 600 /sys/kernel/security/apparmor/.replace \
           /sys/kernel/security/apparmor/.load \
           /sys/kernel/security/apparmor/.remove

# Drop CAP_MAC_ADMIN in container runtimes (Docker example)
docker run --cap-drop=MAC_ADMIN --security-opt no-new-privileges <image>