CVE-2026-80619

apparmor: fix potential UAF in aa_replace_profiles

State: Published
Severity: 7.8 High
Published: Aug 28, 2026
Updated: Aug 29, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix potential UAF in aa_replace_profiles

The function aa_replace_profiles was accessing udata->size after calling aa_put_loaddata(udata), causing a potential UAF.

Fixed this by saving the size to a local variable before dropping the reference.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before 9d8e47cbce7536f19c96e37d0685a042010187eeAffected 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before 9d37dc6376e336dc4b4f39a7ad0d069aa70e9495Affected 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before c0f3a3fda617beeec58708720304dd026a1a4dd7Affected 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before 5cba148eae6e8550c2889f5c0f94d72bed864321Affected 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before c44de0880b7ccc15c70a6352b5e107677d32b061Affected 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before 57b1bd4486d56254bb8af1a8f3d4445bbe505290Affected 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before dd5f1202f45a2dbe2c7dd10093f5c6bb2d8ac5bbAffected 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before 7b42f95813dc9ceb6bda35afcf914630909a19f9Affected
LinuxLinux	4.11Affected before 4.11Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before 9d8e47cbce7536f19c96e37d0685a042010187eeAffected
5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before 9d37dc6376e336dc4b4f39a7ad0d069aa70e9495Affected
5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before c0f3a3fda617beeec58708720304dd026a1a4dd7Affected
5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before 5cba148eae6e8550c2889f5c0f94d72bed864321Affected
5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before c44de0880b7ccc15c70a6352b5e107677d32b061Affected
5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before 57b1bd4486d56254bb8af1a8f3d4445bbe505290Affected
5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before dd5f1202f45a2dbe2c7dd10093f5c6bb2d8ac5bbAffected
5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 to before 7b42f95813dc9ceb6bda35afcf914630909a19f9Affected

LinuxLinux

4.11Affected
before 4.11Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.