Description

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix potential UAF in aa_replace_profiles The function aa_replace_profiles was accessing udata->size after calling aa_put_loaddata(udata), causing a potential UAF. Fixed this by saving the size to a local variable before dropping the reference.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-28T08:16:45.950Z",
  "pubdate": "2026-08-28T08:16:45.950Z",
  "executiveSummary": "This vulnerability is a Use-After-Free (UAF) flaw identified within the Linux kernel's AppArmor security module, specifically located in the aa_replace_profiles function.\nThe issue arises from a race condition or improper reference management where the kernel accesses memory associated with the udata object after it has been deallocated or its reference count has been dropped via aa_put_loaddata.\nThe primary risk involves potential memory corruption, kernel crashes (denial of service), or possible arbitrary code execution if an attacker can manipulate the freed memory slab.\nThe vulnerability affects systems utilizing the AppArmor security module. Exploitation generally requires a local user with sufficient privileges to interact with the security module's policy loading interface, typically requiring CAP_MAC_ADMIN or equivalent root-level capabilities.\nSuccessful exploitation could allow an attacker to trigger a kernel panic or, in more complex scenarios, potentially achieve code execution by influencing the kernel's object allocator through heap grooming techniques.",
  "technicalDetails": "The root cause of this vulnerability is a reference count mismanagement within the kernel's AppArmor profile replacement routine. In the affected versions of the Linux kernel, the function aa_replace_profiles handles the loading and replacement of security policies by referencing the udata structure, which contains policy binary data and metadata.\nThe vulnerability occurs because the function invokes aa_put_loaddata(udata) to release the reference to the policy data structure before it finishes processing the udata object. Specifically, the kernel continues to access the udata->size field after the reference count has reached zero and the memory has potentially been marked for reclamation by the kernel's slab allocator.\nThis creates a classic Use-After-Free (UAF) condition. If the kernel allocator reuses the memory previously occupied by the udata structure for another task before the size-related logic is completed, the kernel reads stale or attacker-controlled data instead of the original policy size. This can lead to unpredictable behavior, including integer overflows, out-of-bounds reads, or memory corruption.\nThe exploitation flow typically involves an attacker crafting a specific set of policy replacement requests. By timing the sequence of aa_replace_profiles calls and forcing the slab allocator to reuse the freed memory region, an attacker could theoretically influence the control flow of the kernel if the corrupted size value is used to govern subsequent memory allocations or buffer copies.\nThe vulnerable component is the AppArmor LSM (Linux Security Module) policy management interface. Because this interface interacts with user-supplied blobs, the attack vector is local. An attacker requires local access to the system and must possess the necessary privileges to manage AppArmor policies (e.g., CAP_MAC_ADMIN) to trigger the faulty code path.\nThe remediation involves decoupling the required metadata from the object lifecycle. By reading the udata->size value and storing it in a local variable on the stack before invoking aa_put_loaddata, the kernel ensures that the processing logic does not rely on the potentially deallocated memory region. This fix effectively mitigates the UAF by guaranteeing that the data is accessed only while the reference is still valid."
}