CVE-2026-80619

apparmor: fix potential UAF in aa_replace_profiles

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix potential UAF in aa_replace_profiles

The function aa_replace_profiles was accessing udata->size after calling aa_put_loaddata(udata), causing a potential UAF.

Fixed this by saving the size to a local variable before dropping the reference.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.18%Unchanged since Aug 28, 2026

What each source reports

CVE List Score used 7.8

apparmor: fix potential UAF in aa_replace_profiles

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix potential UAF in aa_replace_profiles

The function aa_replace_profiles was accessing udata->size after calling aa_put_loaddata(udata), causing a potential UAF.

Fixed this by saving the size to a local variable before dropping the reference.

Record: CVE-2026-80619
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2026-67495 7.8

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix potential UAF in aa_replace_profiles

The function aa_replace_profiles was accessing udata->size after calling aa_put_loaddata(udata), causing a potential UAF.

Fixed this by saving the size to a local variable before dropping the reference.

Record: EUVD-2026-67495
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-m5rp-7qww-6j53 7.8

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix potential UAF...

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix potential UAF in aa_replace_profiles

The function aa_replace_profiles was accessing udata->size after calling aa_put_loaddata(udata), causing a potential UAF.

Fixed this by saving the size to a local variable before dropping the reference.

Record: GHSA-m5rp-7qww-6j53
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix potential UAF in aa_replace_profiles

The function aa_replace_profiles was accessing udata->size after calling aa_put_loaddata(udata), causing a potential UAF.

Fixed this by saving the size to a local variable before dropping the reference.

Record: CVE-2026-80619
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-80619 7.8

Record: BELL-CVE-2026-80619
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

apparmor: fix potential UAF in aa_replace_profiles

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix potential UAF in aa_replace_profiles

The function aa_replace_profiles was accessing udata->size after calling aa_put_loaddata(udata), causing a potential UAF.

Fixed this by saving the size to a local variable before dropping the reference.

Record: CVE-2026-80619
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 22 moreShow less

OSVDEBIAN-CVE-2026-80619 7.8

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix potential UAF in aa_replace_profiles The function aa_replace_profiles was accessing udata->size after calling aa_put_loaddata(udata), causing a potential UAF. Fixed this by saving the size to a local variable before dropping the reference.

Record: DEBIAN-CVE-2026-80619
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-3706 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:net: af_can: do not leave a dangling sk pointer in can_create()On error can_create() frees the allocated sk object, but sock_init_data()has already attached it to the provided sock object. This will leave adangling sk pointer in the sock object and may cause use-after-free later.(CVE-2024-56603)

In the Linux kernel, the following vulnerability has been resolved:

hdlc_ppp: sync per-proto timers before freeing hdlc state

Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp registers a timer via timer_setup(). That struct ppp is the hdlc->state allocation, which detach_hdlc_protocol() frees with kfree() in both teardown paths: unregister_hdlc_device() and the re-attach inside attach_hdlc_protocol().

The ppp proto never registered a .detach callback, so detach_hdlc_protocol() performs no timer synchronization before the kfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(), is partial (it does not wait for a running callback) and only runs on the ->CLOSED transition; ppp_stop()/ppp_close() do not sync either. A ppp_timer callback already executing (blocked on ppp->lock) survives the kfree and then dereferences proto->state / ppp->lock in freed memory, leading to a use-after-free.

Fix this by adding a .detach helper that calls timer_shutdown_sync() on every per-proto timer. detach_hdlc_protocol() invokes proto->detach(dev) before kfree(hdlc->state), so timer_shutdown_sync() now runs on both free paths. timer_shutdown_sync() is used instead of timer_delete_sync() because the keepalive path re-arms the timer through add_timer()/mod_timer() and shutdown blocks any re-activation during teardown.

Initialize the per-protocol timers in ppp_ioctl() when the protocol is attached, and remove the now-redundant timer_setup() from ppp_start(), so that the timers are initialized exactly once at attach time and ppp_timer_release() never operates on uninitialized timer_list structures. attach_hdlc_protocol() uses kmalloc() (not kzalloc), so struct ppp's protos[i].timer is uninitialized garbage until the first timer_setup(); without this init-at-attach, attaching the PPP protocol without ever bringing the device up would leave timer_shutdown_sync() operating on uninitialized memory in .detach. Moving the init out of ppp_start() (which only runs on NETDEV_UP) into the attach path makes the initialization unconditional and avoids initializing the same timer_list twice.

This bug was found by static analysis.(CVE-2026-63803)

In the Linux kernel, the following vulnerability has been resolved:

parport: Fix race between port and client registration

The parport subsystem registers port devices before they are fully initialised, resulting in a race condition where client drivers such as lp can attach to ports that are not completely initialised or even being torn down.

When the port and client drivers are built as modules and loaded around the same time during boot, this occasionally results in a crash. I was able to make this happen reliably in a VM with a PC-style parallel port by patching parport_pc to fail probing:

> --- a/drivers/parport/parport_pc.c > +++ b/drivers/parport/parport_pc.c > @@ -2069,7 +2069,7 @@ static struct parport *__parport_pc_probe_port(unsigned long int base, > if (!p) > goto out3; > > - base_res = request_region(base, 3, p->name); > + base_res = NULL; > if (!base_res) > goto out4; >

and then running:

while true; do
    modprobe lp &amp; modprobe parport_pc
wait
rmmod lp parport_pc
done

for a few seconds.

In the long term I think port registration should be changed to put the call to device_add() inside parport_announce_port(), but since the latter currently cannot fail this will require changing all port drivers.

For now, add a flag to indicate…

Record: OESA-2026-3706
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-80619 7.8

Record: UBUNTU-CVE-2026-80619
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-10

OSVCLSA-2026-1791132071 No score

Fix of 159 CVEs

CVE-2026-64375
- proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
- exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2026-90413
- IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
CVE-2026-53062
- dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
- dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
CVE-2026-64237
- Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
- Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
CVE-2026-64109
- af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
CVE-2025-38512
- wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
CVE-2025-38117
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
CVE-2026-22980
- nfsd: provide locking for v4_end_grace {CVE-2026-22980}
CVE-2023-53254
- cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
CVE-2025-37885
- KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
CVE-2026-23191
- ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
CVE-2025-37879
- 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
CVE-2023-53039
- HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
CVE-2019-12456
- scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
CVE-2024-46812
- drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
CVE-2026-31761
- iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
CVE-2026-53120
- PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
CVE-2026-31598
- ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
CVE-2026-43075
- ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
CVE-2024-41013
- xfs: don't walk off the end of a directory data block {CVE-2024-41013}
CVE-2026-31527
- driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
CVE-2022-48744
- net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
CVE-2023-53510
- scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
CVE-2026-23268
- apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
CVE-2026-23269
- apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
CVE-2025-21812
- ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
CVE-2026-46266
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
CVE-2026-53228
- ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
CVE-2026-53355
- net: rds: clear i_sends on setup unwind {CVE-2026-53355}
CVE-2026-45970
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
CVE-2023-52922
- can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
CVE-2026-52920
- netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

Record: CLSA-2026-1791132071
Updated: 2026-11-02

OSVCLSA-2026-1791132078 No score

Fix of 160 CVEs

CVE-2026-64375
- proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
- exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2026-90413
- IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
CVE-2026-53062
- dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
- dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
CVE-2026-64237
- Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
- Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
CVE-2026-64109
- af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
CVE-2025-38512
- wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
CVE-2025-38117
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
CVE-2026-22980
- nfsd: provide locking for v4_end_grace {CVE-2026-22980}
CVE-2023-53254
- cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
CVE-2025-37885
- KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
CVE-2026-23191
- ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
CVE-2025-37879
- 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
CVE-2023-53039
- HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
CVE-2019-12456
- scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
CVE-2024-46812
- drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
CVE-2026-31761
- iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
CVE-2026-53120
- PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
CVE-2026-31598
- ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
CVE-2026-43075
- ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
CVE-2024-41013
- xfs: don't walk off the end of a directory data block {CVE-2024-41013}
CVE-2026-31527
- driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
CVE-2022-48744
- net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
CVE-2023-53510
- scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
CVE-2026-23268
- apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
CVE-2026-23269
- apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
CVE-2025-21812
- ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
CVE-2026-46266
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
CVE-2026-53228
- ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
CVE-2026-53355
- net: rds: clear i_sends on setup unwind {CVE-2026-53355}
CVE-2026-45970
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
CVE-2023-52922
- can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
CVE-2026-52920
- netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

Record: CLSA-2026-1791132078
Updated: 2026-11-02

OSVCLSA-2026-1791132991 No score

Fix of 400 CVEs

CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2025-39827
- net: rose: include node references in rose_neigh refcount {CVE-2025-39827}
CVE-2026-93140
- udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
CVE-2026-90112
- net: qlcnic: validate unified ROM sections before loading {CVE-2026-90112}
CVE-2026-90237
- netfilter: nft_ct: move custom expectation support to helper {CVE-2026-90237}
CVE-2026-93051
- misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051}
CVE-2026-90379
- wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash {CVE-2026-90379}
CVE-2026-90302
- ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
CVE-2026-90383
- misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
CVE-2026-90320
- ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
CVE-2026-93047
- drm/v3d: Associate BOs with every job that accesses them {CVE-2026-93047}
CVE-2026-93192
- drm/v3d: Clear queue->active_job when v3d_fence_create() fails {CVE-2026-93192}
CVE-2026-93050
- ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove {CVE-2026-93050}
CVE-2026-90311
- thermal: hwmon: Remove hwmon class device along with its parent {CVE-2026-90311}
CVE-2026-93191
- smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191}
CVE-2026-93042
- dmaengine: dw-edma: Terminate all descriptors without callbacks {CVE-2026-93042}
CVE-2026-93056
- usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056}
CVE-2026-93203
- batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203}
CVE-2026-93204
- batman-adv: dat: atomically update mac addresses {CVE-2026-93204}
CVE-2026-90000
- HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}
CVE-2026-90431
- remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
CVE-2026-93202
- i3c: master: Fix recursive locking during device registration {CVE-2026-93202}
CVE-2026-90347
- arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry {CVE-2026-90347}
CVE-2026-90267
- scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
CVE-2026-92500
- ext4: use fsdata to track inline data write state and fix race {CVE-2026-92500}
CVE-2026-93196
- nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196}
CVE-2026-90207
- ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207}
CVE-2026-90307
- RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
CVE-2026-90110
- inetpeer: randomize RB-tree node comparison using SipHash {CVE-2026-90110}
CVE-2026-90293
- IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
CVE-2026-89838
- f2fs: limit recovery filename logging to stored length {CVE-2026-89838}
CVE-2026-93177
- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177}
CVE-2026-89823
- drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
CVE-2026-90041
- HID: sony: clean up device list on probe failure {CVE-2026-90041}
CVE-2026-90015
- xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
CVE-2026-93095 -…

Record: CLSA-2026-1791132991
Updated: 2026-11-02

OSVUSN-8875-1 No score

linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-realtime, linux-xilinx-zynqmp vulnerabilities

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)