CyberSecBulletin
CVE-2026-63827NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-63827 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 643221da57dbb1a8fd800610331cf1ec27969f71, b17f0c59cc1525765625cf07d0391b7f9c1ed7e5, a7a2890028f16e5b0af0bb005d80fcb32559cca3 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.12% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 643221da57dbb1a8fd800610331cf1ec27969f71 or b17f0c59cc1525765625cf07d0391b7f9c1ed7e5 or a7a2890028f16e5b0af0bb005d80fcb32559cca3 or 15fd83a1e42ede15070968806bb6c8b1a5170688, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.261 or 5.15.212 or 6.1.177 or 6.6.144, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux3b8e77c7abab40e6de9ad9de730d77984a498840 up to, but not including, 643221da57dbb1a8fd800610331cf1ec27969f71; d9d8560b9b7932f8cffc4c068c14289220900f79 up to, but not including, b17f0c59cc1525765625cf07d0391b7f9c1ed7e5; 6b6ba87579c7e7c669e0bec91823e7fb693bc5df up to, but not including, a7a2890028f16e5b0af0bb005d80fcb32559cca3; 6ef1f2926c41ab96952d9696d55a052f1b3a9418 up to, but not including, 15fd83a1e42ede15070968806bb6c8b1a5170688; f9761add6d100962a23996cb68f3d6abdd4d1815 up to, but not including, ce261a20b41db522e320a41bbf1292bf85af66df; af782cc8871e3683ddd5a3cd2f7df526599863a9 up to, but not including, c3ca2631073b2cef06824fd2bfc452ff7a1023de; a0b7091c4de45a7325c8780e6934a894f92ac86b up to, but not including, 5e34fa9f6f7cd688ae153fff13139a5cf2d42339; a0b7091c4de45a7325c8780e6934a894f92ac86b up to, but not including, 6f060496d03e4dc560a40f73770bd08335cb7a27; and 9 more ranges643221da57dbb1a8fd800610331cf1ec27969f71, b17f0c59cc1525765625cf07d0391b7f9c1ed7e5, a7a2890028f16e5b0af0bb005d80fcb32559cca3, 15fd83a1e42ede15070968806bb6c8b1a5170688, ce261a20b41db522e320a41bbf1292bf85af66df, c3ca2631073b2cef06824fd2bfc452ff7a1023de
LinuxLinux Kernel5.10.253 up to, but not including, 5.10.261; 5.15.203 up to, but not including, 5.15.212; 6.1.169 up to, but not including, 6.1.177; 6.6.130 up to, but not including, 6.6.144; 6.12.77 up to, but not including, 6.12.95; 6.18.18 up to, but not including, 6.18.38; 6.19.8 up to, but not including, 7.0; 7.0.1 up to, but not including, 7.1.3; and 1 more ranges5.10.261, 5.15.212, 6.1.177, 6.6.144, 6.12.95, 6.18.38

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aa_loaddata, list membership does not hold a reference: profiles hold pcount, and when the last pcount drops, do_ploaddata_rmfs() is queued on a workqueue that takes ns->lock and removes the entry. Between dropping the last pcount and the workqueue running, an entry remains on the list with pcount == 0. aa_get_profile_loaddata() is an unconditional kref_get() on pcount, so when the dedup loop hits such an entry, refcount hardening reports refcount_t: addition on 0; use-after-free. inside aa_replace_profiles(), and the poisoned counter then trips "saturated" and "underflow" warnings on the subsequent uses of the same loaddata. Before commit a0b7091c4de4 ("apparmor: fix race on rawdata dereference") the dedup path used a get_unless_zero-style helper on a single counter, so the existing "if (tmp)" guard was meaningful. The split-refcount refactor introduced aa_get_profile_loaddata(), which has plain kref_get() semantics, and the guard quietly became a no-op. Introduce aa_get_profile_loaddata_not0(), matching the existing _not0 convention used by aa_get_profile_not0(), and use it for the rawdata_list dedup lookup so dying entries are skipped. Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu 24.04 + stress-ng 0.17.06: stress-ng --apparmor 1 --klog-check --timeout 60s Without this patch the three refcount_t warnings fire within a few seconds. With it the same 60 s run is clean. Coverage is a smoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN and CONFIG_PROVE_LOCKING would be welcome from anyone with the cycles.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.