Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23410— apparmor: fix race on rawdata dereference

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于rawdata取消引用存在竞争条件，可能导致释放后重用。

CVSS 7.8 · High EPSS 0.14% · P3

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 5d5182cae40115c03933989473288e54afb39c7c< 3b8e77c7abab40e6de9ad9de730d77984a498840 affected
5d5182cae40115c03933989473288e54afb39c7c< d9d8560b9b7932f8cffc4c068c14289220900f79 affected
5d5182cae40115c03933989473288e54afb39c7c< 6b6ba87579c7e7c669e0bec91823e7fb693bc5df affected
5d5182cae40115c03933989473288e54afb39c7c< 6ef1f2926c41ab96952d9696d55a052f1b3a9418 affected
5d5182cae40115c03933989473288e54afb39c7c< f9761add6d100962a23996cb68f3d6abdd4d1815 affected
5d5182cae40115c03933989473288e54afb39c7c< af782cc8871e3683ddd5a3cd2f7df526599863a9 affected
5d5182cae40115c03933989473288e54afb39c7c< 763e838adc3c7ec5a7df2990ce84cad951e42721 affected
5d5182cae40115c03933989473288e54afb39c7c< a0b7091c4de45a7325c8780e6934a894f92ac86b affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23410

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
apparmor: fix race on rawdata dereference
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata dereference There is a race condition that leads to a use-after-free situation: because the rawdata inodes are not refcounted, an attacker can start open()ing one of the rawdata files, and at the same time remove the last reference to this rawdata (by removing the corresponding profile, for example), which frees its struct aa_loaddata; as a result, when seq_rawdata_open() is reached, i_private is a dangling pointer and freed memory is accessed. The rawdata inodes weren't refcounted to avoid a circular refcount and were supposed to be held by the profile rawdata reference. However during profile removal there is a window where the vfs and profile destruction race, resulting in the use after free. Fix this by moving to a double refcount scheme. Where the profile refcount on rawdata is used to break the circular dependency. Allowing for freeing of the rawdata once all inode references to the rawdata are put.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于rawdata取消引用存在竞争条件，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5d5182cae40115c03933989473288e54afb39c7c ~ 3b8e77c7abab40e6de9ad9de730d77984a498840 -
Linux Linux 4.13 -

II. Public POCs for CVE-2026-23410

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23410

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-04-01 · 11 CVEs total

CVE-2026-23411 7.8 HIGH apparmor: fix race between freeing data and fs accessing it
CVE-2026-23408 7.8 HIGH apparmor: Fix double free of ns_name in aa_replace_profiles()
CVE-2026-23407 7.8 HIGH apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
CVE-2026-23406 7.8 HIGH apparmor: fix side-effect bug in match_char() macro usage
CVE-2026-23409 apparmor: fix differential encoding verification
CVE-2026-23405 apparmor: fix: limit the number of levels of policy namespaces
CVE-2026-23404 apparmor: replace recursive profile removal with iterative approach
CVE-2026-23403 apparmor: fix memory leak in verify_header
CVE-2026-23402 KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE
CVE-2026-23401 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23410

No comments yet

Leave a comment