Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23405— apparmor: fix: limit the number of levels of policy namespaces

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于策略命名空间层级数量未限制，可能导致耗尽系统资源。

AI Predicted 5.5 Difficulty: Easy EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux c88d4c7b049e87998ac0a9f455aa545cc895ef92< 6b396cc2f0365e684fc1d3547d18ef79fcee225d affected
c88d4c7b049e87998ac0a9f455aa545cc895ef92< 87d0cecc900e55d55fc4dbfb43ac93e269c7a5b3 affected
c88d4c7b049e87998ac0a9f455aa545cc895ef92< b1226e37eb3754d389721c135db6107db94c7a72 affected
c88d4c7b049e87998ac0a9f455aa545cc895ef92< 3f8699b3ee0c04b4b9bc27b82cd89a40e81e1d2e affected
c88d4c7b049e87998ac0a9f455aa545cc895ef92< 853ce31ca72097d23991a06876a2ccb5cb64b603 affected
c88d4c7b049e87998ac0a9f455aa545cc895ef92< d42b2b6bb77ca40ee34ab74ad79305840b5f315d affected
c88d4c7b049e87998ac0a9f455aa545cc895ef92< 7b6495ead2c611647f6b11441a852324e3eb8616 affected
c88d4c7b049e87998ac0a9f455aa545cc895ef92< 306039414932c80f8420695a24d4fe10c84ccfb2 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23405

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
apparmor: fix: limit the number of levels of policy namespaces
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix: limit the number of levels of policy namespaces Currently the number of policy namespaces is not bounded relying on the user namespace limit. However policy namespaces aren't strictly tied to user namespaces and it is possible to create them and nest them arbitrarily deep which can be used to exhaust system resource. Hard cap policy namespaces to the same depth as user namespaces.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于策略命名空间层级数量未限制，可能导致耗尽系统资源。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux c88d4c7b049e87998ac0a9f455aa545cc895ef92 ~ 6b396cc2f0365e684fc1d3547d18ef79fcee225d -
Linux Linux 2.6.36 -

II. Public POCs for CVE-2026-23405

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23405

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-04-01 · 11 CVEs total

CVE-2026-23411 7.8 HIGH apparmor: fix race between freeing data and fs accessing it
CVE-2026-23410 7.8 HIGH apparmor: fix race on rawdata dereference
CVE-2026-23408 7.8 HIGH apparmor: Fix double free of ns_name in aa_replace_profiles()
CVE-2026-23407 7.8 HIGH apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
CVE-2026-23406 7.8 HIGH apparmor: fix side-effect bug in match_char() macro usage
CVE-2026-23409 apparmor: fix differential encoding verification
CVE-2026-23404 apparmor: replace recursive profile removal with iterative approach
CVE-2026-23403 apparmor: fix memory leak in verify_header
CVE-2026-23402 KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE
CVE-2026-23401 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23405

No comments yet

Leave a comment