CVE-2026-63827

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.1-rc5

Description A use-after-free issue exists in the AppArmor module of the Linux kernel during the rawdata deduplication loop. The function aa replace profiles() iterates through ns->rawdata list to deduplicate incoming policy blobs. A race condition occurs when an entry remains on the list with a reference count (pcount) of 0 before the workqueue executes do ploaddata rmfs() to remove it. Because aa get profile loaddata() performs an unconditional kref get() on pcount, it can trigger a use-after-free when encountering these dying entries.

Recommendations Update the Linux kernel to a version where the aa get profile loaddata not0() function has been introduced and implemented within aa replace profiles() to ensure entries with a zero reference count are skipped.