CVE-2026-80619 (GCVE-0-2026-80619)
Vulnerability from cvelistv5
Published
2026-08-28 06:48
Modified
2026-08-29 06:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix potential UAF in aa_replace_profiles
The function aa_replace_profiles was accessing udata->size after calling
aa_put_loaddata(udata), causing a potential UAF.
Fixed this by saving the size to a local variable before dropping the
reference.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 Version: 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 Version: 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 Version: 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 Version: 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 Version: 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 Version: 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 Version: 5ac8c355ae0013d82b3a07b49aebeadfce9b6e52 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/apparmor/policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9d8e47cbce7536f19c96e37d0685a042010187ee",
"status": "affected",
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"versionType": "git"
},
{
"lessThan": "9d37dc6376e336dc4b4f39a7ad0d069aa70e9495",
"status": "affected",
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"versionType": "git"
},
{
"lessThan": "c0f3a3fda617beeec58708720304dd026a1a4dd7",
"status": "affected",
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"versionType": "git"
},
{
"lessThan": "5cba148eae6e8550c2889f5c0f94d72bed864321",
"status": "affected",
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"versionType": "git"
},
{
"lessThan": "c44de0880b7ccc15c70a6352b5e107677d32b061",
"status": "affected",
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"versionType": "git"
},
{
"lessThan": "57b1bd4486d56254bb8af1a8f3d4445bbe505290",
"status": "affected",
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"versionType": "git"
},
{
"lessThan": "dd5f1202f45a2dbe2c7dd10093f5c6bb2d8ac5bb",
"status": "affected",
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"versionType": "git"
},
{
"lessThan": "7b42f95813dc9ceb6bda35afcf914630909a19f9",
"status": "affected",
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/apparmor/policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix potential UAF in aa_replace_profiles\n\nThe function aa_replace_profiles was accessing udata-\u003esize after calling\naa_put_loaddata(udata), causing a potential UAF.\n\nFixed this by saving the size to a local variable before dropping the\nreference."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is only reachable via local write() to AppArmor policy management interfaces (/sys/kernel/security/apparmor/.load or .replace, or namespace .load/.replace under apparmorfs), which invoke policy_update() -\u003e aa_replace_profiles(); there is no network or adjacent protocol path.\nAC:L - An attacker with policy-admin rights can trigger the bug by loading or replacing policy (including duplicate rawdata dedup paths) while concurrently removing/replacing profiles so aa_put_profile_loaddata() at the out label can drop the last pcount and schedule do_ploaddata_rmfs() before udata-\u003esize is read; the attacker controls both sides of this race.\nPR:L - aa_replace_profiles() is gated by aa_may_manage_policy(), which requires CAP_MAC_ADMIN and policy-view rights; with default unprivileged_userns_apparmor_policy=1, namespace UID 0 in an unprivileged user namespace can satisfy these without init-namespace root, matching prior AppArmor policy-load CVE scoring.\nUI:N - Exploitation requires only the attacker\u0027s own write of policy data to .load/.replace; no separate victim action, mount, or administrator interaction beyond the attacker\u0027s policy-management operation is needed.\nS:U - The UAF corrupts kernel AppArmor loaddata within the same OS security authority as the caller; it is standard kernel memory corruption/local privilege escalation, not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Reading udata-\u003esize after aa_put_profile_loaddata() is a use-after-free on struct aa_loaddata; freed heap objects can be reallocated and the size field read gives attacker-influenced kernel heap disclosure primitives per kernel CVSS UAF guidance.\nI:H - UAF on aa_loaddata enables heap grooming and corruption of adjacent kernel objects through controlled policy load/free timing, providing a well-established path to arbitrary kernel writes and local privilege escalation beyond the initial policy-admin capability.\nA:H - When the last profile reference is dropped at cleanup, the deferred free can run before the post-put size read, causing refcount corruption, kernel oops/BUG, or panic; UAF bugs are scored Availability High even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T06:21:26.537Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9d8e47cbce7536f19c96e37d0685a042010187ee"
},
{
"url": "https://git.kernel.org/stable/c/9d37dc6376e336dc4b4f39a7ad0d069aa70e9495"
},
{
"url": "https://git.kernel.org/stable/c/c0f3a3fda617beeec58708720304dd026a1a4dd7"
},
{
"url": "https://git.kernel.org/stable/c/5cba148eae6e8550c2889f5c0f94d72bed864321"
},
{
"url": "https://git.kernel.org/stable/c/c44de0880b7ccc15c70a6352b5e107677d32b061"
},
{
"url": "https://git.kernel.org/stable/c/57b1bd4486d56254bb8af1a8f3d4445bbe505290"
},
{
"url": "https://git.kernel.org/stable/c/dd5f1202f45a2dbe2c7dd10093f5c6bb2d8ac5bb"
},
{
"url": "https://git.kernel.org/stable/c/7b42f95813dc9ceb6bda35afcf914630909a19f9"
}
],
"title": "apparmor: fix potential UAF in aa_replace_profiles",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80619",
"datePublished": "2026-08-28T06:48:38.702Z",
"dateReserved": "2026-08-26T14:34:25.774Z",
"dateUpdated": "2026-08-29T06:21:26.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…