EUVD-2026-45493

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aareplaceprofiles walks ns-rawdatalist to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aaloaddata, list...

CVE-2026-63827

Root cause: Linux kernel AppArmor uses a use-after-free in the rawdata dedup loop (aa_replace_profiles) due to unsafe refcount handling when traversing ns->rawdata_list. The dedup path calls aa_get_profile_loaddata() which has plain kref_get() semantics, allowing a zero counter to be dereferen...