CVE-2026-80619

A use-after-free (UAF) flaw exists in the Linux kernel's AppArmor security module: in aa_replace_profiles(), the code read udata->size after releasing the load-data object via aa_put_loaddata(), so the pointer could reference already-freed memory. The flaw is triggered when AppArmor policy profiles are loaded or replaced from userspace through the kernel's policy-load interface. A local attacker with limited privileges (per the CVSS scoring) who can cause profile replacement could exploit the stale-pointer access to corrupt kernel memory, with high potential impact to confidentiality, integrity and availability, which in kernel UAFs typically means privilege escalation. All Linux systems running kernels that contain the vulnerable aa_replace_profiles code are potentially affected; the advisory does not specify an affected or fixed kernel version range. As of this publication there is no known exploitation, no public proof-of-concept, and EPSS estimates the 30-day exploitation probability at about 0.1% (3rd percentile).

What to do: Apply the kernel update for your distribution as soon as it publishes a patch incorporating the upstream aa_replace_profiles fix (watch Ubuntu, Debian and SUSE kernel security advisories; no fixed version number is given in this advisory). Until patched, restrict AppArmor profile loading/replacement to trusted administrators on multi-tenant hosts, since the defect is exercised through the policy-load path. No public exploit exists and EPSS is low, so patching can be scheduled with normal maintenance cadence rather than emergency response.