Skip to main content

Linux Kernel CVE-2026-63827

| EUVDEUVD-2026-45493 HIGH
2026-07-19 Linux GHSA-gpp3-g5wp-8xhw
Information Disclosure Linux Ubuntu
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local AppArmor-load capability
  2. Delivery
    Rapidly replace AppArmor profiles
  3. Exploit
    Race dedup loop vs removal workqueue
  4. Execution
    kref_get on pcount==0 loaddata
  5. Persist
    Corrupt freed kernel object
  6. Impact
    Escalate privileges or crash kernel

Vulnerability Assessment

Exploitation Conditions

Exploitation requires local code execution plus the capability to trigger AppArmor policy replacement (aa_replace_profiles), i.e. the ability to load/replace AppArmor profiles - normally CAP_MAC_ADMIN in the relevant namespace - on a kernel built and running with AppArmor enabled (Ubuntu/SUSE default; not present on kernels without AppArmor). It further depends on winning a narrow timing race: the attacker must hit the dedup loop in the window between the last pcount reference being dropped and the do_ploaddata_rmfs() workqueue (which takes ns->lock) unlinking the entry, so rapid repeated policy replacement is needed to make the race practical. Limiting factors: no network vector (local only), no exploitation against kernels lacking AppArmor, privileged policy-load capability required, and a non-deterministic race that raises real-world difficulty above the vendor's AC:L rating.
Impact

Signals are broadly consistent in pointing to a real-but-not-urgent local kernel bug. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H = 7.8 HIGH) reflects a local, low-privilege attacker gaining high confidentiality/integrity/availability impact, typical of kernel memory corruption. However AC:L likely understates reality: the flaw is a time-bound race between the last pcount drop and workqueue execution, which argues for AC:H, and triggering the policy-replacement path realistically requires AppArmor policy-load capability (CAP_MAC_ADMIN), suggesting PR:H rather than PR:L. EPSS is low (0.16%, 6th percentile) and the vulnerability is NOT on CISA KEV, so this is not confirmed actively exploited; no public exploit was identified. The tag 'Information Disclosure' conflicts somewhat with a use-after-free primitive, which more typically enables denial of service or privilege escalation than pure disclosure - the practical impact depends on heap-grooming feasibility of the freed aa_loaddata object. Net: patch on normal kernel-update cadence; not a drop-everything emergency absent local untrusted users with AppArmor-load rights.
Exploit ScenarioDerived

A local attacker with the ability to load AppArmor policy repeatedly replaces profiles (as stress-ng --apparmor does) to race the deduplication loop against the deferred rawdata-removal workqueue, catching an aa_loaddata entry at pcount==0 still on the list. The unconditional kref_get() then operates on a freed/zeroed object, corrupting kernel memory for potential denial of service or privilege escalation. No public exploit has been identified; the original report demonstrates only the refcount-hardening warnings firing within seconds under stress, not a weaponized primitive.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Local privilege-escalation-class memory corruption in the Linux kernel's AppArmor LSM affects the policy-replacement path (aa_replace_profiles) across a wide span of stable branches (5.10 through 7.1). During the rawdata deduplication loop, aa_get_profile_loaddata() performs an unconditional kref_get() on struct aa_loaddata entries whose pcount has already dropped to zero but which remain briefly on ns->rawdata_list before the deferred do_ploaddata_rmfs() workqueue frees them, producing a refcount 'addition on 0' use-after-free. Exploitation requires local access with the ability to load AppArmor policy and winning a narrow race; there is no public exploit identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel for your branch - 6.1.177, 6.6.144, 6.12.95, 6.18.38, or 7.1.3 (mainline 7.2-rc1), whichever matches your series, then reboot to activate the new kernel. On distributions, apply the corresponding distro kernel update (e.g. Ubuntu/SUSE security updates) rather than building from source. The fix commits are available at git.kernel.org (https://git.kernel.org/stable/c/6f060496d03e4dc560a40f73770bd08335cb7a27, https://git.kernel.org/stable/c/5e34fa9f6f7cd688ae153fff13139a5cf2d42339, https://git.kernel.org/stable/c/c3ca2631073b2cef06824fd2bfc452ff7a1023de). If you cannot patch immediately, the practical compensating control is to restrict who can load or replace AppArmor policy: ensure no untrusted or unprivileged users hold CAP_MAC_ADMIN and disallow unprivileged user-namespace policy loading, which removes the attacker's ability to reach aa_replace_profiles (side effect: legitimate confined-container tooling that reloads profiles will be blocked). Disabling AppArmor entirely also closes the path but removes all MAC confinement and is generally not advisable on Ubuntu/SUSE systems that depend on it.

Affected VersionsENISA

Linux patch: 6.6.144
Linux patch: 6.18.38
Linux 7.0
Linux patch: 7.2-rc1
Linux 6.19.8 <6.20
Linux 5.15.203 <5.16
Linux f9761add6d100962a23996cb68f3d6abdd4d1815 <ce261a20b41db522e320a41bbf1292bf85af66df
Linux 6ef1f2926c41ab96952d9696d55a052f1b3a9418 <15fd83a1e42ede15070968806bb6c8b1a5170688
Linux 3b8e77c7abab40e6de9ad9de730d77984a498840
Linux 6b6ba87579c7e7c669e0bec91823e7fb693bc5df <a7a2890028f16e5b0af0bb005d80fcb32559cca3
Linux a0b7091c4de45a7325c8780e6934a894f92ac86b <6f060496d03e4dc560a40f73770bd08335cb7a27
Linux patch: 0
Linux patch: 6.1.177
Linux 6.1.169 <6.1.177
Linux a0b7091c4de45a7325c8780e6934a894f92ac86b <5e34fa9f6f7cd688ae153fff13139a5cf2d42339
Linux af782cc8871e3683ddd5a3cd2f7df526599863a9 <c3ca2631073b2cef06824fd2bfc452ff7a1023de
Linux 6.18.18 <6.18.38
Linux 6.12.77 <6.12.95
Linux 5.10.253 <5.11
Linux patch: 6.12.95
Linux patch: 7.1.3
Linux d9d8560b9b7932f8cffc4c068c14289220900f79
Linux 763e838adc3c7ec5a7df2990ce84cad951e42721
Linux 6.6.130 <6.6.144

Affected Packages

euvd linux fix: 5.11, 5.16, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 6.20

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is AppArmor, a Linux Security Module used to confine processes via loadable policy profiles. The root cause is a lifetime/refcounting defect (CWE-416 Use-After-Free, though the NVD CWE field is N/A) in the split-refcount design of struct aa_loaddata: profiles hold a 'pcount' reference, and mere membership on ns->rawdata_list does NOT hold a reference. When the last pcount is dropped, do_ploaddata_rmfs() is queued on a workqueue that later takes ns->lock to unlink the entry, leaving a window where a pcount==0 object is still list-reachable. The regression was introduced by commit a0b7091c4de4 ('apparmor: fix race on rawdata dereference'), whose split-refcount refactor replaced a get_unless_zero-style single-counter helper with a plain kref_get() in aa_get_profile_loaddata(), silently neutering the existing 'if (tmp)' guard in the dedup path. The CPE data (cpe:2.3:a:linux:linux) identifies the mainline Linux kernel as the affected product; the fix adds aa_get_profile_loaddata_not0() following the existing _not0 convention so dying entries are skipped.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.4 MEDIUM

Triggering requires local AppArmor policy-load privilege (PR:H) and winning a narrow refcount race (AC:H); a kernel UAF can yield full C/I/A compromise.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix use-after-free in rawdata dedup loop

aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aa_loaddata, list membership does not hold a reference: profiles hold pcount, and when the last pcount drops, do_ploaddata_rmfs() is queued on a workqueue that takes ns->lock and removes the entry. Between dropping the last pcount and the workqueue running, an entry remains on the list with pcount == 0.

aa_get_profile_loaddata() is an unconditional kref_get() on pcount, so when the dedup loop hits such an entry, refcount hardening reports

refcount_t: addition on 0; use-after-free.

inside aa_replace_profiles(), and the poisoned counter then trips "saturated" and "underflow" warnings on the subsequent uses of the same loaddata.

Before commit a0b7091c4de4 ("apparmor: fix race on rawdata dereference") the dedup path used a get_unless_zero-style helper on a single counter, so the existing "if (tmp)" guard was meaningful. The split-refcount refactor introduced aa_get_profile_loaddata(), which has plain kref_get() semantics, and the guard quietly became a no-op.

Introduce aa_get_profile_loaddata_not0(), matching the existing _not0 convention used by aa_get_profile_not0(), and use it for the rawdata_list dedup lookup so dying entries are skipped.

Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu 24.04 + stress-ng 0.17.06:

stress-ng --apparmor 1 --klog-check --timeout 60s

Without this patch the three refcount_t warnings fire within a few seconds. With it the same 60 s run is clean. Coverage is a smoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN and CONFIG_PROVE_LOCKING would be welcome from anyone with the cycles.

Executive ViewAI

Why It Matters

A local privilege escalation vulnerability in the Linux kernel's AppArmor security module (CVE-2026-63827) affects systems running kernel versions 5.10 through 7.1. An unprivileged user with the ability to load AppArmor policies could exploit a memory corruption flaw to escalate privileges and compromise system integrity. Organizations operating these kernel versions should prioritize inventory and patching of affected infrastructure.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel; AppArmor enabled by default on Ubuntu/SUSE across vast deployments
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-63827 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/380506 REF https://git.kernel.org/stable/c/15fd83a1e42ede15070968806bb6c8b1a5170688 REF https://git.kernel.org/stable/c/5e34fa9f6f7cd688ae153fff13139a5cf2d42339 REF https://git.kernel.org/stable/c/643221da57dbb1a8fd800610331cf1ec27969f71 REF https://git.kernel.org/stable/c/6f060496d03e4dc560a40f73770bd08335cb7a27 REF https://git.kernel.org/stable/c/a7a2890028f16e5b0af0bb005d80fcb32559cca3 REF https://git.kernel.org/stable/c/b17f0c59cc1525765625cf07d0391b7f9c1ed7e5 REF https://git.kernel.org/stable/c/c3ca2631073b2cef06824fd2bfc452ff7a1023de REF https://git.kernel.org/stable/c/ce261a20b41db522e320a41bbf1292bf85af66df

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy