Vulnerability-Lookup

CERTFR-2026-AVI-0522

Vulnerability from certfr_avis - Published: 2026-04-30 - Updated: 2026-04-30

De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Ubuntu	Ubuntu	Ubuntu 20.04 ESM
	Ubuntu	Ubuntu	Ubuntu 24.04 LTS

References

Title

Publication Time

CVE-2026-23404 (GCVE-0-2026-23404)

Vulnerability from cvelistv5 – Published: 2026-04-01 08:36 – Updated: 2026-05-11 22:06

Title

apparmor: replace recursive profile removal with iterative approach

Summary

In the Linux kernel, the following vulnerability has been resolved: apparmor: replace recursive profile removal with iterative approach The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes. Reproducer: $ pf='a'; for ((i=0; i<1024; i++)); do echo -e "profile $pf { \n }" | apparmor_parser -K -a; pf="$pf//x"; done $ echo -n a > /sys/kernel/security/apparmor/.remove Replace the recursive __aa_profile_list_release() approach with an iterative approach in __remove_profile(). The function repeatedly finds and removes leaf profiles until the entire subtree is removed, maintaining the same removal semantic without recursion.

Severity

No CVSS data available.

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/ea854f032190cc9f2…
https://git.kernel.org/stable/c/4fdc847b107321dec…
https://git.kernel.org/stable/c/b36a04284d0208be9…
https://git.kernel.org/stable/c/33959a491e9fd557a…
https://git.kernel.org/stable/c/999bd704b0b641527…
https://git.kernel.org/stable/c/7eade846e013cbe8d…
https://git.kernel.org/stable/c/a6a941a1294ac5abe…
https://git.kernel.org/stable/c/ab09264660f9de5d0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < ea854f032190cc9f26dc4a0e727090c89e55e342 (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < 4fdc847b107321dec22bf8ecd6019b7af76d7886 (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < b36a04284d0208be94e5e401409caa00e2bf1be1 (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < 33959a491e9fd557abfa5fce5ae4637d400915d3 (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < 999bd704b0b641527a5ed46f0d969deff8cfa68b (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < 7eade846e013cbe8d2dc4a484463aa19e6515c7f (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < a6a941a1294ac5abe22053dc501d25aed96e48fe (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < ab09264660f9de5d05d1ef4e225aa447c63a8747 (git)
Linux	Linux	Affected: 2.6.36 Unaffected: 0 , < 2.6.36 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.169 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.77 , ≤ 6.12.* (semver) Unaffected: 6.18.18 , ≤ 6.18.* (semver) Unaffected: 6.19.8 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea854f032190cc9f26dc4a0e727090c89e55e342",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "4fdc847b107321dec22bf8ecd6019b7af76d7886",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "b36a04284d0208be94e5e401409caa00e2bf1be1",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "33959a491e9fd557abfa5fce5ae4637d400915d3",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "999bd704b0b641527a5ed46f0d969deff8cfa68b",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "7eade846e013cbe8d2dc4a484463aa19e6515c7f",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "a6a941a1294ac5abe22053dc501d25aed96e48fe",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "ab09264660f9de5d05d1ef4e225aa447c63a8747",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: replace recursive profile removal with iterative approach\n\nThe profile removal code uses recursion when removing nested profiles,\nwhich can lead to kernel stack exhaustion and system crashes.\n\nReproducer:\n  $ pf=\u0027a\u0027; for ((i=0; i\u003c1024; i++)); do\n      echo -e \"profile $pf { \\n }\" | apparmor_parser -K -a;\n      pf=\"$pf//x\";\n  done\n  $ echo -n a \u003e /sys/kernel/security/apparmor/.remove\n\nReplace the recursive __aa_profile_list_release() approach with an\niterative approach in __remove_profile(). The function repeatedly\nfinds and removes leaf profiles until the entire subtree is removed,\nmaintaining the same removal semantic without recursion."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:15.286Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea854f032190cc9f26dc4a0e727090c89e55e342"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fdc847b107321dec22bf8ecd6019b7af76d7886"
        },
        {
          "url": "https://git.kernel.org/stable/c/b36a04284d0208be94e5e401409caa00e2bf1be1"
        },
        {
          "url": "https://git.kernel.org/stable/c/33959a491e9fd557abfa5fce5ae4637d400915d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/999bd704b0b641527a5ed46f0d969deff8cfa68b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7eade846e013cbe8d2dc4a484463aa19e6515c7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6a941a1294ac5abe22053dc501d25aed96e48fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab09264660f9de5d05d1ef4e225aa447c63a8747"
        }
      ],
      "title": "apparmor: replace recursive profile removal with iterative approach",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23404",
    "datePublished": "2026-04-01T08:36:35.032Z",
    "dateReserved": "2026-01-13T15:37:46.012Z",
    "dateUpdated": "2026-05-11T22:06:15.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23405 (GCVE-0-2026-23405)

Vulnerability from cvelistv5 – Published: 2026-04-01 08:36 – Updated: 2026-05-11 22:06

Title

apparmor: fix: limit the number of levels of policy namespaces

Summary

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix: limit the number of levels of policy namespaces Currently the number of policy namespaces is not bounded relying on the user namespace limit. However policy namespaces aren't strictly tied to user namespaces and it is possible to create them and nest them arbitrarily deep which can be used to exhaust system resource. Hard cap policy namespaces to the same depth as user namespaces.

Severity

No CVSS data available.

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/6b396cc2f0365e684…
https://git.kernel.org/stable/c/87d0cecc900e55d55…
https://git.kernel.org/stable/c/b1226e37eb3754d38…
https://git.kernel.org/stable/c/3f8699b3ee0c04b4b…
https://git.kernel.org/stable/c/853ce31ca72097d23…
https://git.kernel.org/stable/c/d42b2b6bb77ca40ee…
https://git.kernel.org/stable/c/7b6495ead2c611647…
https://git.kernel.org/stable/c/306039414932c80f8…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < 6b396cc2f0365e684fc1d3547d18ef79fcee225d (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < 87d0cecc900e55d55fc4dbfb43ac93e269c7a5b3 (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < b1226e37eb3754d389721c135db6107db94c7a72 (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < 3f8699b3ee0c04b4b9bc27b82cd89a40e81e1d2e (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < 853ce31ca72097d23991a06876a2ccb5cb64b603 (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < d42b2b6bb77ca40ee34ab74ad79305840b5f315d (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < 7b6495ead2c611647f6b11441a852324e3eb8616 (git) Affected: c88d4c7b049e87998ac0a9f455aa545cc895ef92 , < 306039414932c80f8420695a24d4fe10c84ccfb2 (git)
Linux	Linux	Affected: 2.6.36 Unaffected: 0 , < 2.6.36 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.169 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.77 , ≤ 6.12.* (semver) Unaffected: 6.18.18 , ≤ 6.18.* (semver) Unaffected: 6.19.8 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/policy_ns.h",
            "security/apparmor/policy_ns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b396cc2f0365e684fc1d3547d18ef79fcee225d",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "87d0cecc900e55d55fc4dbfb43ac93e269c7a5b3",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "b1226e37eb3754d389721c135db6107db94c7a72",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "3f8699b3ee0c04b4b9bc27b82cd89a40e81e1d2e",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "853ce31ca72097d23991a06876a2ccb5cb64b603",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "d42b2b6bb77ca40ee34ab74ad79305840b5f315d",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "7b6495ead2c611647f6b11441a852324e3eb8616",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "306039414932c80f8420695a24d4fe10c84ccfb2",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/policy_ns.h",
            "security/apparmor/policy_ns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix: limit the number of levels of policy namespaces\n\nCurrently the number of policy namespaces is not bounded relying on\nthe user namespace limit. However policy namespaces aren\u0027t strictly\ntied to user namespaces and it is possible to create them and nest\nthem arbitrarily deep which can be used to exhaust system resource.\n\nHard cap policy namespaces to the same depth as user namespaces."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:16.436Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b396cc2f0365e684fc1d3547d18ef79fcee225d"
        },
        {
          "url": "https://git.kernel.org/stable/c/87d0cecc900e55d55fc4dbfb43ac93e269c7a5b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1226e37eb3754d389721c135db6107db94c7a72"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f8699b3ee0c04b4b9bc27b82cd89a40e81e1d2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/853ce31ca72097d23991a06876a2ccb5cb64b603"
        },
        {
          "url": "https://git.kernel.org/stable/c/d42b2b6bb77ca40ee34ab74ad79305840b5f315d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b6495ead2c611647f6b11441a852324e3eb8616"
        },
        {
          "url": "https://git.kernel.org/stable/c/306039414932c80f8420695a24d4fe10c84ccfb2"
        }
      ],
      "title": "apparmor: fix: limit the number of levels of policy namespaces",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23405",
    "datePublished": "2026-04-01T08:36:35.697Z",
    "dateReserved": "2026-01-13T15:37:46.012Z",
    "dateUpdated": "2026-05-11T22:06:16.436Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23406 (GCVE-0-2026-23406)

Vulnerability from cvelistv5 – Published: 2026-04-01 08:36 – Updated: 2026-05-11 22:06

Title

apparmor: fix side-effect bug in match_char() macro usage

Summary

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix side-effect bug in match_char() macro usage The match_char() macro evaluates its character parameter multiple times when traversing differential encoding chains. When invoked with *str++, the string pointer advances on each iteration of the inner do-while loop, causing the DFA to check different characters at each iteration and therefore skip input characters. This results in out-of-bounds reads when the pointer advances past the input buffer boundary. [ 94.984676] ================================================================== [ 94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760 [ 94.985655] Read of size 1 at addr ffff888100342000 by task file/976 [ 94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy) [ 94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.986329] Call Trace: [ 94.986341] <TASK> [ 94.986347] dump_stack_lvl+0x5e/0x80 [ 94.986374] print_report+0xc8/0x270 [ 94.986384] ? aa_dfa_match+0x5ae/0x760 [ 94.986388] kasan_report+0x118/0x150 [ 94.986401] ? aa_dfa_match+0x5ae/0x760 [ 94.986405] aa_dfa_match+0x5ae/0x760 [ 94.986408] __aa_path_perm+0x131/0x400 [ 94.986418] aa_path_perm+0x219/0x2f0 [ 94.986424] apparmor_file_open+0x345/0x570 [ 94.986431] security_file_open+0x5c/0x140 [ 94.986442] do_dentry_open+0x2f6/0x1120 [ 94.986450] vfs_open+0x38/0x2b0 [ 94.986453] ? may_open+0x1e2/0x2b0 [ 94.986466] path_openat+0x231b/0x2b30 [ 94.986469] ? __x64_sys_openat+0xf8/0x130 [ 94.986477] do_file_open+0x19d/0x360 [ 94.986487] do_sys_openat2+0x98/0x100 [ 94.986491] __x64_sys_openat+0xf8/0x130 [ 94.986499] do_syscall_64+0x8e/0x660 [ 94.986515] ? count_memcg_events+0x15f/0x3c0 [ 94.986526] ? srso_alias_return_thunk+0x5/0xfbef5 [ 94.986540] ? handle_mm_fault+0x1639/0x1ef0 [ 94.986551] ? vma_start_read+0xf0/0x320 [ 94.986558] ? srso_alias_return_thunk+0x5/0xfbef5 [ 94.986561] ? srso_alias_return_thunk+0x5/0xfbef5 [ 94.986563] ? fpregs_assert_state_consistent+0x50/0xe0 [ 94.986572] ? srso_alias_return_thunk+0x5/0xfbef5 [ 94.986574] ? arch_exit_to_user_mode_prepare+0x9/0xb0 [ 94.986587] ? srso_alias_return_thunk+0x5/0xfbef5 [ 94.986588] ? irqentry_exit+0x3c/0x590 [ 94.986595] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 94.986597] RIP: 0033:0x7fda4a79c3ea Fix by extracting the character value before invoking match_char, ensuring single evaluation per outer loop.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/c7dc56d8b37eda139…
https://git.kernel.org/stable/c/f16f2e5936c0f5f0d…
https://git.kernel.org/stable/c/1fc94f16098213d01…
https://git.kernel.org/stable/c/5a184f7cbdeaad17e…
https://git.kernel.org/stable/c/b73c1dff8a9d7eeae…
https://git.kernel.org/stable/c/0510d1ba0976f97f5…
https://git.kernel.org/stable/c/383b7270faf42564f…
https://git.kernel.org/stable/c/8756b68edae37ff54…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 074c1cd798cb0b481d7eaa749b64aa416563c053 , < c7dc56d8b37eda1396feeec3ab1c7ecee5eae31b (git) Affected: 074c1cd798cb0b481d7eaa749b64aa416563c053 , < f16f2e5936c0f5f0d11fdf10d2be3e47e7108e42 (git) Affected: 074c1cd798cb0b481d7eaa749b64aa416563c053 , < 1fc94f16098213d01e56c97feed9b3ecf0147a37 (git) Affected: 074c1cd798cb0b481d7eaa749b64aa416563c053 , < 5a184f7cbdeaad17e16dedf3c17d0cd622edfed8 (git) Affected: 074c1cd798cb0b481d7eaa749b64aa416563c053 , < b73c1dff8a9d7eeaebabf8097a5b2de192f40913 (git) Affected: 074c1cd798cb0b481d7eaa749b64aa416563c053 , < 0510d1ba0976f97f521feb2b75b0572ea5df3ceb (git) Affected: 074c1cd798cb0b481d7eaa749b64aa416563c053 , < 383b7270faf42564f133134c2fc3c24bbae52615 (git) Affected: 074c1cd798cb0b481d7eaa749b64aa416563c053 , < 8756b68edae37ff546c02091989a4ceab3f20abd (git)
Linux	Linux	Affected: 4.17 Unaffected: 0 , < 4.17 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.169 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.77 , ≤ 6.12.* (semver) Unaffected: 6.18.18 , ≤ 6.18.* (semver) Unaffected: 6.19.8 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c7dc56d8b37eda1396feeec3ab1c7ecee5eae31b",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "f16f2e5936c0f5f0d11fdf10d2be3e47e7108e42",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "1fc94f16098213d01e56c97feed9b3ecf0147a37",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "5a184f7cbdeaad17e16dedf3c17d0cd622edfed8",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "b73c1dff8a9d7eeaebabf8097a5b2de192f40913",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "0510d1ba0976f97f521feb2b75b0572ea5df3ceb",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "383b7270faf42564f133134c2fc3c24bbae52615",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "8756b68edae37ff546c02091989a4ceab3f20abd",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix side-effect bug in match_char() macro usage\n\nThe match_char() macro evaluates its character parameter multiple\ntimes when traversing differential encoding chains. When invoked\nwith *str++, the string pointer advances on each iteration of the\ninner do-while loop, causing the DFA to check different characters\nat each iteration and therefore skip input characters.\nThis results in out-of-bounds reads when the pointer advances past\nthe input buffer boundary.\n\n[   94.984676] ==================================================================\n[   94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760\n[   94.985655] Read of size 1 at addr ffff888100342000 by task file/976\n\n[   94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[   94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   94.986329] Call Trace:\n[   94.986341]  \u003cTASK\u003e\n[   94.986347]  dump_stack_lvl+0x5e/0x80\n[   94.986374]  print_report+0xc8/0x270\n[   94.986384]  ? aa_dfa_match+0x5ae/0x760\n[   94.986388]  kasan_report+0x118/0x150\n[   94.986401]  ? aa_dfa_match+0x5ae/0x760\n[   94.986405]  aa_dfa_match+0x5ae/0x760\n[   94.986408]  __aa_path_perm+0x131/0x400\n[   94.986418]  aa_path_perm+0x219/0x2f0\n[   94.986424]  apparmor_file_open+0x345/0x570\n[   94.986431]  security_file_open+0x5c/0x140\n[   94.986442]  do_dentry_open+0x2f6/0x1120\n[   94.986450]  vfs_open+0x38/0x2b0\n[   94.986453]  ? may_open+0x1e2/0x2b0\n[   94.986466]  path_openat+0x231b/0x2b30\n[   94.986469]  ? __x64_sys_openat+0xf8/0x130\n[   94.986477]  do_file_open+0x19d/0x360\n[   94.986487]  do_sys_openat2+0x98/0x100\n[   94.986491]  __x64_sys_openat+0xf8/0x130\n[   94.986499]  do_syscall_64+0x8e/0x660\n[   94.986515]  ? count_memcg_events+0x15f/0x3c0\n[   94.986526]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986540]  ? handle_mm_fault+0x1639/0x1ef0\n[   94.986551]  ? vma_start_read+0xf0/0x320\n[   94.986558]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986561]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986563]  ? fpregs_assert_state_consistent+0x50/0xe0\n[   94.986572]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986574]  ? arch_exit_to_user_mode_prepare+0x9/0xb0\n[   94.986587]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986588]  ? irqentry_exit+0x3c/0x590\n[   94.986595]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   94.986597] RIP: 0033:0x7fda4a79c3ea\n\nFix by extracting the character value before invoking match_char,\nensuring single evaluation per outer loop."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:17.660Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c7dc56d8b37eda1396feeec3ab1c7ecee5eae31b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f16f2e5936c0f5f0d11fdf10d2be3e47e7108e42"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fc94f16098213d01e56c97feed9b3ecf0147a37"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a184f7cbdeaad17e16dedf3c17d0cd622edfed8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b73c1dff8a9d7eeaebabf8097a5b2de192f40913"
        },
        {
          "url": "https://git.kernel.org/stable/c/0510d1ba0976f97f521feb2b75b0572ea5df3ceb"
        },
        {
          "url": "https://git.kernel.org/stable/c/383b7270faf42564f133134c2fc3c24bbae52615"
        },
        {
          "url": "https://git.kernel.org/stable/c/8756b68edae37ff546c02091989a4ceab3f20abd"
        }
      ],
      "title": "apparmor: fix side-effect bug in match_char() macro usage",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23406",
    "datePublished": "2026-04-01T08:36:36.460Z",
    "dateReserved": "2026-01-13T15:37:46.013Z",
    "dateUpdated": "2026-05-11T22:06:17.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23407 (GCVE-0-2026-23407)

Vulnerability from cvelistv5 – Published: 2026-04-01 08:36 – Updated: 2026-05-11 22:06

Title

apparmor: fix missing bounds check on DEFAULT table in verify_dfa()

Summary

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix missing bounds check on DEFAULT table in verify_dfa() The verify_dfa() function only checks DEFAULT_TABLE bounds when the state is not differentially encoded. When the verification loop traverses the differential encoding chain, it reads k = DEFAULT_TABLE[j] and uses k as an array index without validation. A malformed DFA with DEFAULT_TABLE[j] >= state_count, therefore, causes both out-of-bounds reads and writes. [ 57.179855] ================================================================== [ 57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660 [ 57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993 [ 57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy) [ 57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 57.181563] Call Trace: [ 57.181572] <TASK> [ 57.181577] dump_stack_lvl+0x5e/0x80 [ 57.181596] print_report+0xc8/0x270 [ 57.181605] ? verify_dfa+0x59a/0x660 [ 57.181608] kasan_report+0x118/0x150 [ 57.181620] ? verify_dfa+0x59a/0x660 [ 57.181623] verify_dfa+0x59a/0x660 [ 57.181627] aa_dfa_unpack+0x1610/0x1740 [ 57.181629] ? __kmalloc_cache_noprof+0x1d0/0x470 [ 57.181640] unpack_pdb+0x86d/0x46b0 [ 57.181647] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181653] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181656] ? aa_unpack_nameX+0x1a8/0x300 [ 57.181659] aa_unpack+0x20b0/0x4c30 [ 57.181662] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181664] ? stack_depot_save_flags+0x33/0x700 [ 57.181681] ? kasan_save_track+0x4f/0x80 [ 57.181683] ? kasan_save_track+0x3e/0x80 [ 57.181686] ? __kasan_kmalloc+0x93/0xb0 [ 57.181688] ? __kvmalloc_node_noprof+0x44a/0x780 [ 57.181693] ? aa_simple_write_to_buffer+0x54/0x130 [ 57.181697] ? policy_update+0x154/0x330 [ 57.181704] aa_replace_profiles+0x15a/0x1dd0 [ 57.181707] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181710] ? __kvmalloc_node_noprof+0x44a/0x780 [ 57.181712] ? aa_loaddata_alloc+0x77/0x140 [ 57.181715] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181717] ? _copy_from_user+0x2a/0x70 [ 57.181730] policy_update+0x17a/0x330 [ 57.181733] profile_replace+0x153/0x1a0 [ 57.181735] ? rw_verify_area+0x93/0x2d0 [ 57.181740] vfs_write+0x235/0xab0 [ 57.181745] ksys_write+0xb0/0x170 [ 57.181748] do_syscall_64+0x8e/0x660 [ 57.181762] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.181765] RIP: 0033:0x7f6192792eb2 Remove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE entries unconditionally.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/555829fd91eaf0711…
https://git.kernel.org/stable/c/a75e12ca90c9e70ba…
https://git.kernel.org/stable/c/22094c996968a7c5b…
https://git.kernel.org/stable/c/7c7cf05e0606f554c…
https://git.kernel.org/stable/c/76b4d36c512286645…
https://git.kernel.org/stable/c/5a68e46dfe0c8c8ff…
https://git.kernel.org/stable/c/f39e126e56c6ec193…
https://git.kernel.org/stable/c/d352873bbefa7eb39…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 555829fd91eaf0711e369b0a92aecb0f0aa3281f (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 22094c996968a7c5b59cd3fc9fcbdfdd46d02fec (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 7c7cf05e0606f554c467e3a4dc49e2e578a755b4 (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 76b4d36c5122866452d34d8f79985e191f9c3831 (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < d352873bbefa7eb39995239d0b44ccdf8aaa79a4 (git)
Linux	Linux	Affected: 4.17 Unaffected: 0 , < 4.17 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.169 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.77 , ≤ 6.12.* (semver) Unaffected: 6.18.18 , ≤ 6.18.* (semver) Unaffected: 6.19.8 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "555829fd91eaf0711e369b0a92aecb0f0aa3281f",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "22094c996968a7c5b59cd3fc9fcbdfdd46d02fec",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "7c7cf05e0606f554c467e3a4dc49e2e578a755b4",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "76b4d36c5122866452d34d8f79985e191f9c3831",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "d352873bbefa7eb39995239d0b44ccdf8aaa79a4",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix missing bounds check on DEFAULT table in verify_dfa()\n\nThe verify_dfa() function only checks DEFAULT_TABLE bounds when the state\nis not differentially encoded.\n\nWhen the verification loop traverses the differential encoding chain,\nit reads k = DEFAULT_TABLE[j] and uses k as an array index without\nvalidation. A malformed DFA with DEFAULT_TABLE[j] \u003e= state_count,\ntherefore, causes both out-of-bounds reads and writes.\n\n[   57.179855] ==================================================================\n[   57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660\n[   57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993\n\n[   57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[   57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   57.181563] Call Trace:\n[   57.181572]  \u003cTASK\u003e\n[   57.181577]  dump_stack_lvl+0x5e/0x80\n[   57.181596]  print_report+0xc8/0x270\n[   57.181605]  ? verify_dfa+0x59a/0x660\n[   57.181608]  kasan_report+0x118/0x150\n[   57.181620]  ? verify_dfa+0x59a/0x660\n[   57.181623]  verify_dfa+0x59a/0x660\n[   57.181627]  aa_dfa_unpack+0x1610/0x1740\n[   57.181629]  ? __kmalloc_cache_noprof+0x1d0/0x470\n[   57.181640]  unpack_pdb+0x86d/0x46b0\n[   57.181647]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181653]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181656]  ? aa_unpack_nameX+0x1a8/0x300\n[   57.181659]  aa_unpack+0x20b0/0x4c30\n[   57.181662]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181664]  ? stack_depot_save_flags+0x33/0x700\n[   57.181681]  ? kasan_save_track+0x4f/0x80\n[   57.181683]  ? kasan_save_track+0x3e/0x80\n[   57.181686]  ? __kasan_kmalloc+0x93/0xb0\n[   57.181688]  ? __kvmalloc_node_noprof+0x44a/0x780\n[   57.181693]  ? aa_simple_write_to_buffer+0x54/0x130\n[   57.181697]  ? policy_update+0x154/0x330\n[   57.181704]  aa_replace_profiles+0x15a/0x1dd0\n[   57.181707]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181710]  ? __kvmalloc_node_noprof+0x44a/0x780\n[   57.181712]  ? aa_loaddata_alloc+0x77/0x140\n[   57.181715]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181717]  ? _copy_from_user+0x2a/0x70\n[   57.181730]  policy_update+0x17a/0x330\n[   57.181733]  profile_replace+0x153/0x1a0\n[   57.181735]  ? rw_verify_area+0x93/0x2d0\n[   57.181740]  vfs_write+0x235/0xab0\n[   57.181745]  ksys_write+0xb0/0x170\n[   57.181748]  do_syscall_64+0x8e/0x660\n[   57.181762]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   57.181765] RIP: 0033:0x7f6192792eb2\n\nRemove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE\nentries unconditionally."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:18.806Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/555829fd91eaf0711e369b0a92aecb0f0aa3281f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/22094c996968a7c5b59cd3fc9fcbdfdd46d02fec"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c7cf05e0606f554c467e3a4dc49e2e578a755b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/76b4d36c5122866452d34d8f79985e191f9c3831"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/d352873bbefa7eb39995239d0b44ccdf8aaa79a4"
        }
      ],
      "title": "apparmor: fix missing bounds check on DEFAULT table in verify_dfa()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23407",
    "datePublished": "2026-04-01T08:36:37.197Z",
    "dateReserved": "2026-01-13T15:37:46.013Z",
    "dateUpdated": "2026-05-11T22:06:18.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23409 (GCVE-0-2026-23409)

Vulnerability from cvelistv5 – Published: 2026-04-01 08:36 – Updated: 2026-05-11 22:06

Title

apparmor: fix differential encoding verification

Summary

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix differential encoding verification Differential encoding allows loops to be created if it is abused. To prevent this the unpack should verify that a diff-encode chain terminates. Unfortunately the differential encode verification had two bugs. 1. it conflated states that had gone through check and already been marked, with states that were currently being checked and marked. This means that loops in the current chain being verified are treated as a chain that has already been verified. 2. the order bailout on already checked states compared current chain check iterators j,k instead of using the outer loop iterator i. Meaning a step backwards in states in the current chain verification was being mistaken for moving to an already verified state. Move to a double mark scheme where already verified states get a different mark, than the current chain being kept. This enables us to also drop the backwards verification check that was the cause of the second error as any already verified state is already marked.

Severity

No CVSS data available.

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/ff7c73744fafe944e…
https://git.kernel.org/stable/c/1439150cd3c411228…
https://git.kernel.org/stable/c/0fab44285445e9012…
https://git.kernel.org/stable/c/f90e3ecd9e1ed69f1…
https://git.kernel.org/stable/c/34fc60b125ed1d4eb…
https://git.kernel.org/stable/c/623a9d211bbbb031b…
https://git.kernel.org/stable/c/1ff4857fac56ac5a9…
https://git.kernel.org/stable/c/39440b137546a3aa3…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < ff7c73744fafe944ed9a7b2b7cf6c8d5557a3d84 (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 1439150cd3c411228b387ab5efca92199d2a659a (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 0fab44285445e9012674396d5c1236a67da518e0 (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < f90e3ecd9e1ed69f1a370f866ceed1f104f3ab4a (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 34fc60b125ed1d4eb002c76b0664bf0619492167 (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 623a9d211bbbb031bb1cbdb38b23487648167f8a (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 1ff4857fac56ac5a90ee63b24db05fa5e91a45aa (git) Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 39440b137546a3aa383cfdabc605fb73811b6093 (git)
Linux	Linux	Affected: 4.17 Unaffected: 0 , < 4.17 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.169 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.77 , ≤ 6.12.* (semver) Unaffected: 6.18.18 , ≤ 6.18.* (semver) Unaffected: 6.19.8 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/match.h",
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ff7c73744fafe944ed9a7b2b7cf6c8d5557a3d84",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "1439150cd3c411228b387ab5efca92199d2a659a",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "0fab44285445e9012674396d5c1236a67da518e0",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "f90e3ecd9e1ed69f1a370f866ceed1f104f3ab4a",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "34fc60b125ed1d4eb002c76b0664bf0619492167",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "623a9d211bbbb031bb1cbdb38b23487648167f8a",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "1ff4857fac56ac5a90ee63b24db05fa5e91a45aa",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "39440b137546a3aa383cfdabc605fb73811b6093",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/match.h",
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix differential encoding verification\n\nDifferential encoding allows loops to be created if it is abused. To\nprevent this the unpack should verify that a diff-encode chain\nterminates.\n\nUnfortunately the differential encode verification had two bugs.\n\n1. it conflated states that had gone through check and already been\n   marked, with states that were currently being checked and marked.\n   This means that loops in the current chain being verified are treated\n   as a chain that has already been verified.\n\n2. the order bailout on already checked states compared current chain\n   check iterators j,k instead of using the outer loop iterator i.\n   Meaning a step backwards in states in the current chain verification\n   was being mistaken for moving to an already verified state.\n\nMove to a double mark scheme where already verified states get a\ndifferent mark, than the current chain being kept. This enables us\nto also drop the backwards verification check that was the cause of\nthe second error as any already verified state is already marked."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:21.118Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ff7c73744fafe944ed9a7b2b7cf6c8d5557a3d84"
        },
        {
          "url": "https://git.kernel.org/stable/c/1439150cd3c411228b387ab5efca92199d2a659a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fab44285445e9012674396d5c1236a67da518e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f90e3ecd9e1ed69f1a370f866ceed1f104f3ab4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/34fc60b125ed1d4eb002c76b0664bf0619492167"
        },
        {
          "url": "https://git.kernel.org/stable/c/623a9d211bbbb031bb1cbdb38b23487648167f8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ff4857fac56ac5a90ee63b24db05fa5e91a45aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/39440b137546a3aa383cfdabc605fb73811b6093"
        }
      ],
      "title": "apparmor: fix differential encoding verification",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23409",
    "datePublished": "2026-04-01T08:36:38.516Z",
    "dateReserved": "2026-01-13T15:37:46.013Z",
    "dateUpdated": "2026-05-11T22:06:21.118Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23410 (GCVE-0-2026-23410)

Vulnerability from cvelistv5 – Published: 2026-04-01 08:36 – Updated: 2026-05-11 22:06

Title

apparmor: fix race on rawdata dereference

Summary

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata dereference There is a race condition that leads to a use-after-free situation: because the rawdata inodes are not refcounted, an attacker can start open()ing one of the rawdata files, and at the same time remove the last reference to this rawdata (by removing the corresponding profile, for example), which frees its struct aa_loaddata; as a result, when seq_rawdata_open() is reached, i_private is a dangling pointer and freed memory is accessed. The rawdata inodes weren't refcounted to avoid a circular refcount and were supposed to be held by the profile rawdata reference. However during profile removal there is a window where the vfs and profile destruction race, resulting in the use after free. Fix this by moving to a double refcount scheme. Where the profile refcount on rawdata is used to break the circular dependency. Allowing for freeing of the rawdata once all inode references to the rawdata are put.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/3b8e77c7abab40e6d…
https://git.kernel.org/stable/c/d9d8560b9b7932f8c…
https://git.kernel.org/stable/c/6b6ba87579c7e7c66…
https://git.kernel.org/stable/c/6ef1f2926c41ab969…
https://git.kernel.org/stable/c/f9761add6d100962a…
https://git.kernel.org/stable/c/af782cc8871e3683d…
https://git.kernel.org/stable/c/763e838adc3c7ec5a…
https://git.kernel.org/stable/c/a0b7091c4de45a732…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 5d5182cae40115c03933989473288e54afb39c7c , < 3b8e77c7abab40e6de9ad9de730d77984a498840 (git) Affected: 5d5182cae40115c03933989473288e54afb39c7c , < d9d8560b9b7932f8cffc4c068c14289220900f79 (git) Affected: 5d5182cae40115c03933989473288e54afb39c7c , < 6b6ba87579c7e7c669e0bec91823e7fb693bc5df (git) Affected: 5d5182cae40115c03933989473288e54afb39c7c , < 6ef1f2926c41ab96952d9696d55a052f1b3a9418 (git) Affected: 5d5182cae40115c03933989473288e54afb39c7c , < f9761add6d100962a23996cb68f3d6abdd4d1815 (git) Affected: 5d5182cae40115c03933989473288e54afb39c7c , < af782cc8871e3683ddd5a3cd2f7df526599863a9 (git) Affected: 5d5182cae40115c03933989473288e54afb39c7c , < 763e838adc3c7ec5a7df2990ce84cad951e42721 (git) Affected: 5d5182cae40115c03933989473288e54afb39c7c , < a0b7091c4de45a7325c8780e6934a894f92ac86b (git)
Linux	Linux	Affected: 4.13 Unaffected: 0 , < 4.13 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.169 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.77 , ≤ 6.12.* (semver) Unaffected: 6.18.18 , ≤ 6.18.* (semver) Unaffected: 6.19.8 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/apparmorfs.c",
            "security/apparmor/include/policy_unpack.h",
            "security/apparmor/policy.c",
            "security/apparmor/policy_unpack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b8e77c7abab40e6de9ad9de730d77984a498840",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "d9d8560b9b7932f8cffc4c068c14289220900f79",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "6b6ba87579c7e7c669e0bec91823e7fb693bc5df",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "6ef1f2926c41ab96952d9696d55a052f1b3a9418",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "f9761add6d100962a23996cb68f3d6abdd4d1815",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "af782cc8871e3683ddd5a3cd2f7df526599863a9",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "763e838adc3c7ec5a7df2990ce84cad951e42721",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "a0b7091c4de45a7325c8780e6934a894f92ac86b",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/apparmorfs.c",
            "security/apparmor/include/policy_unpack.h",
            "security/apparmor/policy.c",
            "security/apparmor/policy_unpack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix race on rawdata dereference\n\nThere is a race condition that leads to a use-after-free situation:\nbecause the rawdata inodes are not refcounted, an attacker can start\nopen()ing one of the rawdata files, and at the same time remove the\nlast reference to this rawdata (by removing the corresponding profile,\nfor example), which frees its struct aa_loaddata; as a result, when\nseq_rawdata_open() is reached, i_private is a dangling pointer and\nfreed memory is accessed.\n\nThe rawdata inodes weren\u0027t refcounted to avoid a circular refcount and\nwere supposed to be held by the profile rawdata reference.  However\nduring profile removal there is a window where the vfs and profile\ndestruction race, resulting in the use after free.\n\nFix this by moving to a double refcount scheme. Where the profile\nrefcount on rawdata is used to break the circular dependency. Allowing\nfor freeing of the rawdata once all inode references to the rawdata\nare put."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:22.297Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b8e77c7abab40e6de9ad9de730d77984a498840"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9d8560b9b7932f8cffc4c068c14289220900f79"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b6ba87579c7e7c669e0bec91823e7fb693bc5df"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ef1f2926c41ab96952d9696d55a052f1b3a9418"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9761add6d100962a23996cb68f3d6abdd4d1815"
        },
        {
          "url": "https://git.kernel.org/stable/c/af782cc8871e3683ddd5a3cd2f7df526599863a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/763e838adc3c7ec5a7df2990ce84cad951e42721"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0b7091c4de45a7325c8780e6934a894f92ac86b"
        }
      ],
      "title": "apparmor: fix race on rawdata dereference",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23410",
    "datePublished": "2026-04-01T08:36:39.202Z",
    "dateReserved": "2026-01-13T15:37:46.013Z",
    "dateUpdated": "2026-05-11T22:06:22.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23411 (GCVE-0-2026-23411)

Vulnerability from cvelistv5 – Published: 2026-04-01 08:36 – Updated: 2026-05-11 22:06

Title

apparmor: fix race between freeing data and fs accessing it

Summary

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the inode can aand does live beyond that point and it is possible that some of the fs call back functions will be invoked after the reference has been put, which results in a race between freeing the data and accessing it through the fs. While the rawdata/loaddata is the most likely candidate to fail the race, as it has the fewest references. If properly crafted it might be possible to trigger a race for the other types stored in i_private. Fix this by moving the put of i_private referenced data to the correct place which is during inode eviction.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/a92c5e5086a87d082…
https://git.kernel.org/stable/c/667df93769c02ff58…
https://git.kernel.org/stable/c/3ddb961d2929bbb32…
https://git.kernel.org/stable/c/ae10787d955fb255d…
https://git.kernel.org/stable/c/eecce026399917f6e…
https://git.kernel.org/stable/c/13bc2772414d68e94…
https://git.kernel.org/stable/c/2a732ed26fbd048e7…
https://git.kernel.org/stable/c/8e135b8aee5a06c52…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c961ee5f21b202dea60b63eeef945730d92e46a6 , < a92c5e5086a87d082696245a8607666da3d80554 (git) Affected: c961ee5f21b202dea60b63eeef945730d92e46a6 , < 667df93769c02ff581c77d2d8f162147e719c557 (git) Affected: c961ee5f21b202dea60b63eeef945730d92e46a6 , < 3ddb961d2929bbb3204a2bba21b5d8153cd3f7cc (git) Affected: c961ee5f21b202dea60b63eeef945730d92e46a6 , < ae10787d955fb255d381e0d5589451dd72c614b1 (git) Affected: c961ee5f21b202dea60b63eeef945730d92e46a6 , < eecce026399917f6efa532c56bc7a3e9dd6ee68b (git) Affected: c961ee5f21b202dea60b63eeef945730d92e46a6 , < 13bc2772414d68e94e273dea013181a986948ddf (git) Affected: c961ee5f21b202dea60b63eeef945730d92e46a6 , < 2a732ed26fbd048e7925d227af8cf9ea43fb5cc9 (git) Affected: c961ee5f21b202dea60b63eeef945730d92e46a6 , < 8e135b8aee5a06c52a4347a5a6d51223c6f36ba3 (git)
Linux	Linux	Affected: 4.13 Unaffected: 0 , < 4.13 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.169 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.77 , ≤ 6.12.* (semver) Unaffected: 6.18.18 , ≤ 6.18.* (semver) Unaffected: 6.19.8 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/apparmorfs.c",
            "security/apparmor/include/label.h",
            "security/apparmor/include/lib.h",
            "security/apparmor/include/policy.h",
            "security/apparmor/include/policy_unpack.h",
            "security/apparmor/label.c",
            "security/apparmor/policy_unpack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a92c5e5086a87d082696245a8607666da3d80554",
              "status": "affected",
              "version": "c961ee5f21b202dea60b63eeef945730d92e46a6",
              "versionType": "git"
            },
            {
              "lessThan": "667df93769c02ff581c77d2d8f162147e719c557",
              "status": "affected",
              "version": "c961ee5f21b202dea60b63eeef945730d92e46a6",
              "versionType": "git"
            },
            {
              "lessThan": "3ddb961d2929bbb3204a2bba21b5d8153cd3f7cc",
              "status": "affected",
              "version": "c961ee5f21b202dea60b63eeef945730d92e46a6",
              "versionType": "git"
            },
            {
              "lessThan": "ae10787d955fb255d381e0d5589451dd72c614b1",
              "status": "affected",
              "version": "c961ee5f21b202dea60b63eeef945730d92e46a6",
              "versionType": "git"
            },
            {
              "lessThan": "eecce026399917f6efa532c56bc7a3e9dd6ee68b",
              "status": "affected",
              "version": "c961ee5f21b202dea60b63eeef945730d92e46a6",
              "versionType": "git"
            },
            {
              "lessThan": "13bc2772414d68e94e273dea013181a986948ddf",
              "status": "affected",
              "version": "c961ee5f21b202dea60b63eeef945730d92e46a6",
              "versionType": "git"
            },
            {
              "lessThan": "2a732ed26fbd048e7925d227af8cf9ea43fb5cc9",
              "status": "affected",
              "version": "c961ee5f21b202dea60b63eeef945730d92e46a6",
              "versionType": "git"
            },
            {
              "lessThan": "8e135b8aee5a06c52a4347a5a6d51223c6f36ba3",
              "status": "affected",
              "version": "c961ee5f21b202dea60b63eeef945730d92e46a6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/apparmorfs.c",
            "security/apparmor/include/label.h",
            "security/apparmor/include/lib.h",
            "security/apparmor/include/policy.h",
            "security/apparmor/include/policy_unpack.h",
            "security/apparmor/label.c",
            "security/apparmor/policy_unpack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix race between freeing data and fs accessing it\n\nAppArmor was putting the reference to i_private data on its end after\nremoving the original entry from the file system. However the inode\ncan aand does live beyond that point and it is possible that some of\nthe fs call back functions will be invoked after the reference has\nbeen put, which results in a race between freeing the data and\naccessing it through the fs.\n\nWhile the rawdata/loaddata is the most likely candidate to fail the\nrace, as it has the fewest references. If properly crafted it might be\npossible to trigger a race for the other types stored in i_private.\n\nFix this by moving the put of i_private referenced data to the correct\nplace which is during inode eviction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:23.444Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a92c5e5086a87d082696245a8607666da3d80554"
        },
        {
          "url": "https://git.kernel.org/stable/c/667df93769c02ff581c77d2d8f162147e719c557"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ddb961d2929bbb3204a2bba21b5d8153cd3f7cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae10787d955fb255d381e0d5589451dd72c614b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/eecce026399917f6efa532c56bc7a3e9dd6ee68b"
        },
        {
          "url": "https://git.kernel.org/stable/c/13bc2772414d68e94e273dea013181a986948ddf"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a732ed26fbd048e7925d227af8cf9ea43fb5cc9"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e135b8aee5a06c52a4347a5a6d51223c6f36ba3"
        }
      ],
      "title": "apparmor: fix race between freeing data and fs accessing it",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23411",
    "datePublished": "2026-04-01T08:36:39.819Z",
    "dateReserved": "2026-01-13T15:37:46.013Z",
    "dateUpdated": "2026-05-11T22:06:23.444Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2026-AVI-0522

Solutions

CVE-2026-23404 (GCVE-0-2026-23404)

CVE-2026-23405 (GCVE-0-2026-23405)

CVE-2026-23406 (GCVE-0-2026-23406)

CVE-2026-23407 (GCVE-0-2026-23407)

CVE-2026-23409 (GCVE-0-2026-23409)

CVE-2026-23410 (GCVE-0-2026-23410)

CVE-2026-23411 (GCVE-0-2026-23411)

Tags

Sightings

Nomenclature