AppArmor can free a process's credentials while they are still in use

3f4ae5fab613 (Jann Horn) landed via merge 8fefe68784ae (apparmor-pr-2026-08-26, Aug 6). Files security/apparmor/include/cred.h, task.h, and task.c. Profile replace or disable could swap creds from a VFS hook. A later getuid after aa-disable during a blocked splice hit a KASAN use-after-free. Fixes: c75afcd153f6. Cc: stable. No public CVE.

The sibling label-list overflow is its own card.

Not a recast of 13084b29.