CVE-2026-63827: Software Security Vulnerability Vulnerability

HIGH

Advisory Identifier: GHSA-gpp3-g5wp-8xhw

CVSS 7.8

Published 2026-07-19

Advisory Summary

CVE-2026-63827 is a HIGH (CVSS 7.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-63827 at a Glance

CVE Identifier CVE-2026-63827

GHSA Identifier GHSA-gpp3-g5wp-8xhw

Severity HIGH

CVSS v3.1 Base Score 7.8

CWE Classification General Security Weakness

Affected Product Software

Package Ecosystem Maven

Published Date 2026-07-19

Last Updated 2026-07-24

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)

Attack Complexity Low (AC:L)

Privileges Required Low (PR:L)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

How to Fix CVE-2026-63827

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-63827, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aa_loaddata, list membership does not hold a reference: profiles hold pcount, and when the last pcount drops, do_ploaddata_rmfs() is queued on a workqueue that takes ns->lock and removes the entry. Between dropping the last pcount and the workqueue running, an entry remains on the list with pcount == 0. aa_get_profile_loaddata() is an unconditional kref_get() on pcount, so when the dedup loop hits such an entry, refcount hardening reports refcount_t: addition on 0; use-after-free. inside aa_replace_profiles(), and the poisoned counter then trips "saturated" and "underflow" warnings on the subsequent uses of the same loaddata. Before commit a0b7091c4de4 ("apparmor: fix race on rawdata dereference") the dedup path used a get_unless_zero-style helper on a single counter, so the existing "if (tmp)" guard was meaningful. The split-refcount refactor introduced aa_get_profile_loaddata(), which has plain kref_get() semantics, and the guard quietly became a no-op. Introduce aa_get_profile_loaddata_not0(), matching the existing _not0 convention used by aa_get_profile_not0(), and use it for the rawdata_list dedup lookup so dying entries are skipped. Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu 24.04 + stress-ng 0.17.06: stress-ng --apparmor 1 --klog-check --timeout 60s Without this patch the three refcount_t warnings fire within a few seconds. With it the same 60 s run is clean. Coverage is a smoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN and CONFIG_PROVE_LOCKING would be welcome from anyone with the cycles.

References

NVD — CVE-2026-63827 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-63827

git.kernel.org/stable/c/15fd83a1e4... WEB

https://git.kernel.org/stable/c/15fd83a1e42ede15070968806bb6c8b1a5170688

git.kernel.org/stable/c/5e34fa9f6f... WEB

https://git.kernel.org/stable/c/5e34fa9f6f7cd688ae153fff13139a5cf2d42339

git.kernel.org/stable/c/643221da57... WEB

https://git.kernel.org/stable/c/643221da57dbb1a8fd800610331cf1ec27969f71

git.kernel.org/stable/c/6f060496d0... WEB

https://git.kernel.org/stable/c/6f060496d03e4dc560a40f73770bd08335cb7a27

git.kernel.org/stable/c/a7a2890028... WEB

https://git.kernel.org/stable/c/a7a2890028f16e5b0af0bb005d80fcb32559cca3

git.kernel.org/stable/c/b17f0c59cc... WEB

https://git.kernel.org/stable/c/b17f0c59cc1525765625cf07d0391b7f9c1ed7e5

git.kernel.org/stable/c/c3ca263107... WEB

https://git.kernel.org/stable/c/c3ca2631073b2cef06824fd2bfc452ff7a1023de

git.kernel.org/stable/c/ce261a20b4... WEB

https://git.kernel.org/stable/c/ce261a20b41db522e320a41bbf1292bf85af66df

Frequently Asked Questions

What is CVE-2026-63827?

CVE-2026-63827 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.

Which Software versions are affected?

Affected versions include releases prior to current release patches.

What version fixes CVE-2026-63827?

Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.

What is the CVSS score of CVE-2026-63827?

CVE-2026-63827 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

What CWE is associated with CVE-2026-63827?

CVE-2026-63827 is classified under General Security Weakness.

How can I check Maven dependencies for CVE-2026-63827?

Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gpp3-g5wp-8xhw",
  "modified" : "2026-07-24T15:32:43Z",
  "published" : "2026-07-19T12:30:24Z",
  "aliases" : [ "CVE-2026-63827" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix use-after-free in rawdata dedup loop\n\naa_replace_profiles() walks ns->rawdata_list to dedup the incoming\npolicy blob against entries already attached to existing profiles.\nPer the kernel-doc on struct aa_loaddata, list membership does not\nhold a reference: profiles hold pcount, and when the last pcount\ndrops, do_ploaddata_rmfs() is queued on a workqueue that takes\nns->lock and removes the entry. Between dropping the last pcount\nand the workqueue running, an entry remains on the list with\npcount == 0.\n\naa_get_profile_loaddata() is an unconditional kref_get() on\npcount, so when the dedup loop hits such an entry, refcount\nhardening reports\n\n  refcount_t: addition on 0; use-after-free.\n\ninside aa_replace_profiles(), and the poisoned counter then\ntrips \"saturated\" and \"underflow\" warnings on the subsequent\nuses of the same loaddata.\n\nBefore commit a0b7091c4de4 (\"apparmor: fix race on rawdata\ndereference\") the dedup path used a get_unless_zero-style helper\non a single counter, so the existing \"if (tmp)\" guard was\nmeaningful. The split-refcount refactor introduced\naa_get_profile_loaddata(), which has plain kref_get() semantics,\nand the guard quietly became a no-op.\n\nIntroduce aa_get_profile_loaddata_not0(), matching the existing\n_not0 convention used by aa_get_profile_not0(), and use it for\nthe rawdata_list dedup lookup so dying entries are skipped.\n\nReproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu\n24.04 + stress-ng 0.17.06:\n\n  stress-ng --apparmor 1 --klog-check --timeout 60s\n\nWithout this patch the three refcount_t warnings fire within a\nfew seconds. With it the same 60 s run is clean. Coverage is a\nsmoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN\nand CONFIG_PROVE_LOCKING would be welcome from anyone with the\ncycles.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-63827"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/15fd83a1e42ede15070968806bb6c8b1a5170688"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5e34fa9f6f7cd688ae153fff13139a5cf2d42339"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/643221da57dbb1a8fd800610331cf1ec27969f71"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6f060496d03e4dc560a40f73770bd08335cb7a27"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a7a2890028f16e5b0af0bb005d80fcb32559cca3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b17f0c59cc1525765625cf07d0391b7f9c1ed7e5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c3ca2631073b2cef06824fd2bfc452ff7a1023de"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ce261a20b41db522e320a41bbf1292bf85af66df"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-19T12:16:55Z"
  }
}

CVSS V3

7.8 HIGH