CVE-2026-23408

Summary

In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix double free of ns_name in aa_replace_profiles()

if ns_name is NULL after 1071 error = aa_unpack(udata, &lh, &ns_name);

and if ent->ns_name contains an ns_name in 1089 } else if (ent->ns_name) {

then ns_name is assigned the ent->ns_name 1095 ns_name = ent->ns_name;

however ent->ns_name is freed at 1262 aa_load_ent_free(ent);

and then again when freeing ns_name at 1270 kfree(ns_name);

Fix this by NULLing out ent->ns_name after it is transferred to ns_name

")

Affected Software

VendorProductVersion RangeStatus
LinuxLinux145a0ef21c8e944957f58e2c8ffcd8a10f46266a < c6347a2116ecccb8fd9ee4ebc75ae41d1d7ef689affected
LinuxLinux145a0ef21c8e944957f58e2c8ffcd8a10f46266a < c053ae381ce227577567d1ef10090ce7506d7a28affected
LinuxLinux145a0ef21c8e944957f58e2c8ffcd8a10f46266a < 35f4caec1352054b9a61cfdf2bf1898073637aa0affected
LinuxLinux145a0ef21c8e944957f58e2c8ffcd8a10f46266a < 55ef2af7490aaf72f8ffe11ec44c6bcb7eb2162aaffected
LinuxLinux145a0ef21c8e944957f58e2c8ffcd8a10f46266a < 86feeccd6b93ed94bd6655f30de80f163f8d5a45affected
LinuxLinux145a0ef21c8e944957f58e2c8ffcd8a10f46266a < 7998ab3010d2317643f91828f1853d954ef31387affected
LinuxLinux145a0ef21c8e944957f58e2c8ffcd8a10f46266a < 18b5233e860c294a847ee07869d93c0b8673a54baffected
LinuxLinux145a0ef21c8e944957f58e2c8ffcd8a10f46266a < 5df0c44e8f5f619d3beb871207aded7c78414502affected
LinuxLinux5.5affected
LinuxLinux0 < 5.5unaffected
LinuxLinux5.10.253 <= 5.10.*unaffected
LinuxLinux5.15.203 <= 5.15.*unaffected
LinuxLinux6.1.169 <= 6.1.*unaffected
LinuxLinux6.6.130 <= 6.6.*unaffected
LinuxLinux6.12.77 <= 6.12.*unaffected
LinuxLinux6.18.18 <= 6.18.*unaffected
LinuxLinux6.19.8 <= 6.19.*unaffected
LinuxLinux7.0 <= *unaffected

Weaknesses

References