Executive brief
AppArmor is a Linux kernel security module that enforces access control policies on applications. A use-after-free vulnerability in the aa_replace_profiles function could allow a local attacker to read freed kernel memory or trigger a crash, compromising system stability or exposing sensitive kernel data.
Technical details
The vulnerability is a use-after-free (UAF) in the Linux kernel's AppArmor policy module, specifically in the aa_replace_profiles function in security/apparmor/policy.c. The code accessed the udata->size field after calling aa_put_loaddata(udata), which drops the reference to the loaddata structure and may free it. An attacker with local access can trigger this by loading or replacing AppArmor profiles via the policy interface. The fix saves udata->size to a local variable before the reference is dropped, preventing the UAF.
Affected products
- Linux Linux kernel Multiple versions (patched in stable series)
Timeline
- 2026-08-28: disclosed: Published to NVD
- 2026-02-18: patched: Upstream commit 7b42f95813dc9ceb6bda35afcf914630909a19f9 authored by Maxime Bélair
- 2026-07-24: patched: Stable kernel series updated