VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/80xxx/CVE-2026-80619.json
T

264 lines
14 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-80619",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"state": "PUBLISHED",
"assignerShortName": "Linux",
"dateReserved": "2026-08-26T14:34:25.774Z",
"datePublished": "2026-08-28T06:48:38.702Z",
"dateUpdated": "2026-08-29T06:21:26.537Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-08-29T06:21:26.537Z"
},
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix potential UAF in aa_replace_profiles\n\nThe function aa_replace_profiles was accessing udata->size after calling\naa_put_loaddata(udata), causing a potential UAF.\n\nFixed this by saving the size to a local variable before dropping the\nreference."
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is only reachable via local write() to AppArmor policy management interfaces (/sys/kernel/security/apparmor/.load or .replace, or namespace .load/.replace under apparmorfs), which invoke policy_update() -> aa_replace_profiles(); there is no network or adjacent protocol path.\nAC:L - An attacker with policy-admin rights can trigger the bug by loading or replacing policy (including duplicate rawdata dedup paths) while concurrently removing/replacing profiles so aa_put_profile_loaddata() at the out label can drop the last pcount and schedule do_ploaddata_rmfs() before udata->size is read; the attacker controls both sides of this race.\nPR:L - aa_replace_profiles() is gated by aa_may_manage_policy(), which requires CAP_MAC_ADMIN and policy-view rights; with default unprivileged_userns_apparmor_policy=1, namespace UID 0 in an unprivileged user namespace can satisfy these without init-namespace root, matching prior AppArmor policy-load CVE scoring.\nUI:N - Exploitation requires only the attacker's own write of policy data to .load/.replace; no separate victim action, mount, or administrator interaction beyond the attacker's policy-management operation is needed.\nS:U - The UAF corrupts kernel AppArmor loaddata within the same OS security authority as the caller; it is standard kernel memory corruption/local privilege escalation, not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Reading udata->size after aa_put_profile_loaddata() is a use-after-free on struct aa_loaddata; freed heap objects can be reallocated and the size field read gives attacker-influenced kernel heap disclosure primitives per kernel CVSS UAF guidance.\nI:H - UAF on aa_loaddata enables heap grooming and corruption of adjacent kernel objects through controlled policy load/free timing, providing a well-established path to arbitrary kernel writes and local privilege escalation beyond the initial policy-admin capability.\nA:H - When the last profile reference is dropped at cleanup, the deferred free can run before the post-put size read, causing refcount corruption, kernel oops/BUG, or panic; UAF bugs are scored Availability High even when full exploitation is not attempted."
}
]
}
],
"affected": [
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"security/apparmor/policy.c"
],
"versions": [
{
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"lessThan": "9d8e47cbce7536f19c96e37d0685a042010187ee",
"status": "affected",
"versionType": "git"
},
{
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"lessThan": "9d37dc6376e336dc4b4f39a7ad0d069aa70e9495",
"status": "affected",
"versionType": "git"
},
{
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"lessThan": "c0f3a3fda617beeec58708720304dd026a1a4dd7",
"status": "affected",
"versionType": "git"
},
{
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"lessThan": "5cba148eae6e8550c2889f5c0f94d72bed864321",
"status": "affected",
"versionType": "git"
},
{
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"lessThan": "c44de0880b7ccc15c70a6352b5e107677d32b061",
"status": "affected",
"versionType": "git"
},
{
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"lessThan": "57b1bd4486d56254bb8af1a8f3d4445bbe505290",
"status": "affected",
"versionType": "git"
},
{
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"lessThan": "dd5f1202f45a2dbe2c7dd10093f5c6bb2d8ac5bb",
"status": "affected",
"versionType": "git"
},
{
"version": "5ac8c355ae0013d82b3a07b49aebeadfce9b6e52",
"lessThan": "7b42f95813dc9ceb6bda35afcf914630909a19f9",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"security/apparmor/policy.c"
],
"versions": [
{
"version": "4.11",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.11",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.10.261",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.15.212",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.1.178",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.6.145",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.12.97",
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.18.40",
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.1.5",
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "5.10.261"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "5.15.212"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "6.1.178"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "6.6.145"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "6.12.97"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "6.18.40"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "7.1.5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11",
"versionEndExcluding": "7.2"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/9d8e47cbce7536f19c96e37d0685a042010187ee"
},
{
"url": "https://git.kernel.org/stable/c/9d37dc6376e336dc4b4f39a7ad0d069aa70e9495"
},
{
"url": "https://git.kernel.org/stable/c/c0f3a3fda617beeec58708720304dd026a1a4dd7"
},
{
"url": "https://git.kernel.org/stable/c/5cba148eae6e8550c2889f5c0f94d72bed864321"
},
{
"url": "https://git.kernel.org/stable/c/c44de0880b7ccc15c70a6352b5e107677d32b061"
},
{
"url": "https://git.kernel.org/stable/c/57b1bd4486d56254bb8af1a8f3d4445bbe505290"
},
{
"url": "https://git.kernel.org/stable/c/dd5f1202f45a2dbe2c7dd10093f5c6bb2d8ac5bb"
},
{
"url": "https://git.kernel.org/stable/c/7b42f95813dc9ceb6bda35afcf914630909a19f9"
}
],
"title": "apparmor: fix potential UAF in aa_replace_profiles",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
}
}
View Git Blame Copy Permalink