Look up another CVE · open CVE-2026-80619 in the interactive tracker
CVE-2026-80619
apparmor: fix potential UAF in aa_replace_profiles
Published 2026-08-28 (2 months ago) by the Linux kernel CNA. Subsystem security/apparmor. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80619 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The function aa_replace_profiles was accessing udata->size after calling aa_put_loaddata(udata), causing a potential UAF. Fixed this by saving the size to a local variable before dropping the reference.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
security/apparmor/policy.c
- What this is
- APPARMOR SECURITY MODULEMAINTAINERS section matched on security/apparmor/ · apparmor@lists.ubuntu.com · Supported
Check it on the machine
grep -w CONFIG_SECURITY_APPARMOR /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_SECURITY_APPARMOR
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-28 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 6.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- security/apparmor
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.11 | 5.10.261 | 9d8e47cbce75 |
| 4.11 | 5.15.212 | 9d37dc6376e3 |
| 4.11 | 6.1.178 | c0f3a3fda617 |
| 4.11 | 6.6.145 | 5cba148eae6e |
| 4.11 | 6.12.97 | c44de0880b7c |
| 4.11 | 6.18.40 | 57b1bd4486d5 |
| 4.11 | 7.1.5 | dd5f1202f45a |
| 4.11 | 7.2 | 7b42f95813dc |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is only reachable via local write() to AppArmor policy management interfaces (/sys/kernel/security/apparmor/.load or .replace, or namespace .load/.replace under apparmorfs), which invoke policy_update() -> aa_replace_profiles(); there is no network or adjacent protocol path.
- AC:LAttack complexity, low
- An attacker with policy-admin rights can trigger the bug by loading or replacing policy (including duplicate rawdata dedup paths) while concurrently removing/replacing profiles so aa_put_profile_loaddata() at the out label can drop the last pcount and schedule do_ploaddata_rmfs() before udata->size is read; the attacker controls both sides of this race.
- PR:LPrivileges required, low
- aa_replace_profiles() is gated by aa_may_manage_policy(), which requires CAP_MAC_ADMIN and policy-view rights; with default unprivileged_userns_apparmor_policy=1, namespace UID 0 in an unprivileged user namespace can satisfy these without init-namespace root, matching prior AppArmor policy-load CVE scoring.
- UI:NUser interaction, none
- Exploitation requires only the attacker's own write of policy data to .load/.replace; no separate victim action, mount, or administrator interaction beyond the attacker's policy-management operation is needed.
- S:UScope, unchanged
- The UAF corrupts kernel AppArmor loaddata within the same OS security authority as the caller; it is standard kernel memory corruption/local privilege escalation, not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.
- C:HConfidentiality impact, high
- Reading udata->size after aa_put_profile_loaddata() is a use-after-free on struct aa_loaddata; freed heap objects can be reallocated and the size field read gives attacker-influenced kernel heap disclosure primitives per kernel CVSS UAF guidance.
- I:HIntegrity impact, high
- UAF on aa_loaddata enables heap grooming and corruption of adjacent kernel objects through controlled policy load/free timing, providing a well-established path to arbitrary kernel writes and local privilege escalation beyond the initial policy-admin capability.
- A:HAvailability impact, high
- When the last profile reference is dropped at cleanup, the deferred free can run before the post-put size read, causing refcount corruption, kernel oops/BUG, or panic; UAF bugs are scored Availability High even when full exploitation is not attempted.