{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "20656cd1f243d3a154aac5dd1b823110b6906fe1",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            },
            {
              "lessThan": "ed5909992f344a7d3f4024261e9f751d9618a27d",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            },
            {
              "lessThan": "fd28c5618699180cd69619801e9ae6a5266c0a22",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            },
            {
              "lessThan": "459158151a158a6703b49f3c9de0e536d8bd553f",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            },
            {
              "lessThan": "695320de6eadb75aaed8be1787c4ce4c189e4c7b",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            },
            {
              "lessThan": "bce7fe59d43531623f3e43779127bfb33804925d",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            },
            {
              "lessThan": "aad885e774966e97b675dfe928da164214a71605",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE\n\nWhen installing an emulated MMIO SPTE, do so *after* dropping/zapping the\nexisting SPTE (if it\u0027s shadow-present).  While commit a54aa15c6bda3 was\nright about it being impossible to convert a shadow-present SPTE to an\nMMIO SPTE due to a _guest_ write, it failed to account for writes to guest\nmemory that are outside the scope of KVM.\n\nE.g. if host userspace modifies a shadowed gPTE to switch from a memslot\nto emulted MMIO and then the guest hits a relevant page fault, KVM will\ninstall the MMIO SPTE without first zapping the shadow-present SPTE.\n\n  ------------[ cut here ]------------\n  is_shadow_present_pte(*sptep)\n  WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292\n  Modules linked in: kvm_intel kvm irqbypass\n  CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm]\n  Call Trace:\n   \u003cTASK\u003e\n   mmu_set_spte+0x237/0x440 [kvm]\n   ept_page_fault+0x535/0x7f0 [kvm]\n   kvm_mmu_do_page_fault+0xee/0x1f0 [kvm]\n   kvm_mmu_page_fault+0x8d/0x620 [kvm]\n   vmx_handle_exit+0x18c/0x5a0 [kvm_intel]\n   kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm]\n   kvm_vcpu_ioctl+0x2d5/0x980 [kvm]\n   __x64_sys_ioctl+0x8a/0xd0\n   do_syscall_64+0xb5/0x730\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x47fa3f\n   \u003c/TASK\u003e\n  ---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:11.775Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/20656cd1f243d3a154aac5dd1b823110b6906fe1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed5909992f344a7d3f4024261e9f751d9618a27d"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd28c5618699180cd69619801e9ae6a5266c0a22"
        },
        {
          "url": "https://git.kernel.org/stable/c/459158151a158a6703b49f3c9de0e536d8bd553f"
        },
        {
          "url": "https://git.kernel.org/stable/c/695320de6eadb75aaed8be1787c4ce4c189e4c7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bce7fe59d43531623f3e43779127bfb33804925d"
        },
        {
          "url": "https://git.kernel.org/stable/c/aad885e774966e97b675dfe928da164214a71605"
        }
      ],
      "title": "KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23401",
    "datePublished": "2026-04-01T08:36:32.367Z",
    "dateReserved": "2026-01-13T15:37:46.012Z",
    "dateUpdated": "2026-05-11T22:06:11.775Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bab090e8fd5607f77379ea78b9d0c683cb1538a9",
              "status": "affected",
              "version": "11d45175111d933c5175acc28e56af2213dd5cd6",
              "versionType": "git"
            },
            {
              "lessThan": "a1e0f7150639bc30a8e75476d1c7daab77d44992",
              "status": "affected",
              "version": "11d45175111d933c5175acc28e56af2213dd5cd6",
              "versionType": "git"
            },
            {
              "lessThan": "df83746075778958954aa0460cca55f4b3fc9c02",
              "status": "affected",
              "version": "11d45175111d933c5175acc28e56af2213dd5cd6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE\n\nAdjust KVM\u0027s sanity check against overwriting a shadow-present SPTE with a\nanother SPTE with a different target PFN to only apply to direct MMUs,\ni.e. only to MMUs without shadowed gPTEs.  While it\u0027s impossible for KVM\nto overwrite a shadow-present SPTE in response to a guest write, writes\nfrom outside the scope of KVM, e.g. from host userspace, aren\u0027t detected\nby KVM\u0027s write tracking and so can break KVM\u0027s shadow paging rules.\n\n  ------------[ cut here ]------------\n  pfn != spte_to_pfn(*sptep)\n  WARNING: arch/x86/kvm/mmu/mmu.c:3069 at mmu_set_spte+0x1e4/0x440 [kvm], CPU#0: vmx_ept_stale_r/872\n  Modules linked in: kvm_intel kvm irqbypass\n  CPU: 0 UID: 1000 PID: 872 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:mmu_set_spte+0x1e4/0x440 [kvm]\n  Call Trace:\n   \u003cTASK\u003e\n   ept_page_fault+0x535/0x7f0 [kvm]\n   kvm_mmu_do_page_fault+0xee/0x1f0 [kvm]\n   kvm_mmu_page_fault+0x8d/0x620 [kvm]\n   vmx_handle_exit+0x18c/0x5a0 [kvm_intel]\n   kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm]\n   kvm_vcpu_ioctl+0x2d5/0x980 [kvm]\n   __x64_sys_ioctl+0x8a/0xd0\n   do_syscall_64+0xb5/0x730\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u003c/TASK\u003e\n  ---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:12.992Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bab090e8fd5607f77379ea78b9d0c683cb1538a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1e0f7150639bc30a8e75476d1c7daab77d44992"
        },
        {
          "url": "https://git.kernel.org/stable/c/df83746075778958954aa0460cca55f4b3fc9c02"
        }
      ],
      "title": "KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23402",
    "datePublished": "2026-04-01T08:36:33.366Z",
    "dateReserved": "2026-01-13T15:37:46.012Z",
    "dateUpdated": "2026-05-11T22:06:12.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/policy_unpack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9d678eb0fe55c9195d9a253e8c5b82a87b930737",
              "status": "affected",
              "version": "dd51c84857630e77c139afe4d9bba65fc051dc3f",
              "versionType": "git"
            },
            {
              "lessThan": "6b79abcb3c985e153fcf9d395e1d4336081aabc2",
              "status": "affected",
              "version": "dd51c84857630e77c139afe4d9bba65fc051dc3f",
              "versionType": "git"
            },
            {
              "lessThan": "bcf82c0c5a8b383fd2d5d8f3fd880cdcab2ac557",
              "status": "affected",
              "version": "dd51c84857630e77c139afe4d9bba65fc051dc3f",
              "versionType": "git"
            },
            {
              "lessThan": "663ce34786e759ebcbeb3060685c20bcc886d51a",
              "status": "affected",
              "version": "dd51c84857630e77c139afe4d9bba65fc051dc3f",
              "versionType": "git"
            },
            {
              "lessThan": "786e2c2a87d9c505f33321d1fd23a176aa8ddeb1",
              "status": "affected",
              "version": "dd51c84857630e77c139afe4d9bba65fc051dc3f",
              "versionType": "git"
            },
            {
              "lessThan": "4f0889f2df1ab99224a5e1ac4e20437eea5fe38e",
              "status": "affected",
              "version": "dd51c84857630e77c139afe4d9bba65fc051dc3f",
              "versionType": "git"
            },
            {
              "lessThan": "42fd831abfc15d0643c14688f0522556b347e7e6",
              "status": "affected",
              "version": "dd51c84857630e77c139afe4d9bba65fc051dc3f",
              "versionType": "git"
            },
            {
              "lessThan": "e38c55d9f834e5b848bfed0f5c586aaf45acb825",
              "status": "affected",
              "version": "dd51c84857630e77c139afe4d9bba65fc051dc3f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/policy_unpack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix memory leak in verify_header\n\nThe function sets `*ns = NULL` on every call, leaking the namespace\nstring allocated in previous iterations when multiple profiles are\nunpacked. This also breaks namespace consistency checking since *ns\nis always NULL when the comparison is made.\n\nRemove the incorrect assignment.\nThe caller (aa_unpack) initializes *ns to NULL once before the loop,\nwhich is sufficient."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:14.098Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9d678eb0fe55c9195d9a253e8c5b82a87b930737"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b79abcb3c985e153fcf9d395e1d4336081aabc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcf82c0c5a8b383fd2d5d8f3fd880cdcab2ac557"
        },
        {
          "url": "https://git.kernel.org/stable/c/663ce34786e759ebcbeb3060685c20bcc886d51a"
        },
        {
          "url": "https://git.kernel.org/stable/c/786e2c2a87d9c505f33321d1fd23a176aa8ddeb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f0889f2df1ab99224a5e1ac4e20437eea5fe38e"
        },
        {
          "url": "https://git.kernel.org/stable/c/42fd831abfc15d0643c14688f0522556b347e7e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e38c55d9f834e5b848bfed0f5c586aaf45acb825"
        }
      ],
      "title": "apparmor: fix memory leak in verify_header",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23403",
    "datePublished": "2026-04-01T08:36:34.269Z",
    "dateReserved": "2026-01-13T15:37:46.012Z",
    "dateUpdated": "2026-05-11T22:06:14.098Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea854f032190cc9f26dc4a0e727090c89e55e342",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "4fdc847b107321dec22bf8ecd6019b7af76d7886",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "b36a04284d0208be94e5e401409caa00e2bf1be1",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "33959a491e9fd557abfa5fce5ae4637d400915d3",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "999bd704b0b641527a5ed46f0d969deff8cfa68b",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "7eade846e013cbe8d2dc4a484463aa19e6515c7f",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "a6a941a1294ac5abe22053dc501d25aed96e48fe",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "ab09264660f9de5d05d1ef4e225aa447c63a8747",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: replace recursive profile removal with iterative approach\n\nThe profile removal code uses recursion when removing nested profiles,\nwhich can lead to kernel stack exhaustion and system crashes.\n\nReproducer:\n  $ pf=\u0027a\u0027; for ((i=0; i\u003c1024; i++)); do\n      echo -e \"profile $pf { \\n }\" | apparmor_parser -K -a;\n      pf=\"$pf//x\";\n  done\n  $ echo -n a \u003e /sys/kernel/security/apparmor/.remove\n\nReplace the recursive __aa_profile_list_release() approach with an\niterative approach in __remove_profile(). The function repeatedly\nfinds and removes leaf profiles until the entire subtree is removed,\nmaintaining the same removal semantic without recursion."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:15.286Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea854f032190cc9f26dc4a0e727090c89e55e342"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fdc847b107321dec22bf8ecd6019b7af76d7886"
        },
        {
          "url": "https://git.kernel.org/stable/c/b36a04284d0208be94e5e401409caa00e2bf1be1"
        },
        {
          "url": "https://git.kernel.org/stable/c/33959a491e9fd557abfa5fce5ae4637d400915d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/999bd704b0b641527a5ed46f0d969deff8cfa68b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7eade846e013cbe8d2dc4a484463aa19e6515c7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6a941a1294ac5abe22053dc501d25aed96e48fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab09264660f9de5d05d1ef4e225aa447c63a8747"
        }
      ],
      "title": "apparmor: replace recursive profile removal with iterative approach",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23404",
    "datePublished": "2026-04-01T08:36:35.032Z",
    "dateReserved": "2026-01-13T15:37:46.012Z",
    "dateUpdated": "2026-05-11T22:06:15.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/policy_ns.h",
            "security/apparmor/policy_ns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b396cc2f0365e684fc1d3547d18ef79fcee225d",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "87d0cecc900e55d55fc4dbfb43ac93e269c7a5b3",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "b1226e37eb3754d389721c135db6107db94c7a72",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "3f8699b3ee0c04b4b9bc27b82cd89a40e81e1d2e",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "853ce31ca72097d23991a06876a2ccb5cb64b603",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "d42b2b6bb77ca40ee34ab74ad79305840b5f315d",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "7b6495ead2c611647f6b11441a852324e3eb8616",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            },
            {
              "lessThan": "306039414932c80f8420695a24d4fe10c84ccfb2",
              "status": "affected",
              "version": "c88d4c7b049e87998ac0a9f455aa545cc895ef92",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/policy_ns.h",
            "security/apparmor/policy_ns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix: limit the number of levels of policy namespaces\n\nCurrently the number of policy namespaces is not bounded relying on\nthe user namespace limit. However policy namespaces aren\u0027t strictly\ntied to user namespaces and it is possible to create them and nest\nthem arbitrarily deep which can be used to exhaust system resource.\n\nHard cap policy namespaces to the same depth as user namespaces."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:16.436Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b396cc2f0365e684fc1d3547d18ef79fcee225d"
        },
        {
          "url": "https://git.kernel.org/stable/c/87d0cecc900e55d55fc4dbfb43ac93e269c7a5b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1226e37eb3754d389721c135db6107db94c7a72"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f8699b3ee0c04b4b9bc27b82cd89a40e81e1d2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/853ce31ca72097d23991a06876a2ccb5cb64b603"
        },
        {
          "url": "https://git.kernel.org/stable/c/d42b2b6bb77ca40ee34ab74ad79305840b5f315d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b6495ead2c611647f6b11441a852324e3eb8616"
        },
        {
          "url": "https://git.kernel.org/stable/c/306039414932c80f8420695a24d4fe10c84ccfb2"
        }
      ],
      "title": "apparmor: fix: limit the number of levels of policy namespaces",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23405",
    "datePublished": "2026-04-01T08:36:35.697Z",
    "dateReserved": "2026-01-13T15:37:46.012Z",
    "dateUpdated": "2026-05-11T22:06:16.436Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c7dc56d8b37eda1396feeec3ab1c7ecee5eae31b",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "f16f2e5936c0f5f0d11fdf10d2be3e47e7108e42",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "1fc94f16098213d01e56c97feed9b3ecf0147a37",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "5a184f7cbdeaad17e16dedf3c17d0cd622edfed8",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "b73c1dff8a9d7eeaebabf8097a5b2de192f40913",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "0510d1ba0976f97f521feb2b75b0572ea5df3ceb",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "383b7270faf42564f133134c2fc3c24bbae52615",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            },
            {
              "lessThan": "8756b68edae37ff546c02091989a4ceab3f20abd",
              "status": "affected",
              "version": "074c1cd798cb0b481d7eaa749b64aa416563c053",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix side-effect bug in match_char() macro usage\n\nThe match_char() macro evaluates its character parameter multiple\ntimes when traversing differential encoding chains. When invoked\nwith *str++, the string pointer advances on each iteration of the\ninner do-while loop, causing the DFA to check different characters\nat each iteration and therefore skip input characters.\nThis results in out-of-bounds reads when the pointer advances past\nthe input buffer boundary.\n\n[   94.984676] ==================================================================\n[   94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760\n[   94.985655] Read of size 1 at addr ffff888100342000 by task file/976\n\n[   94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[   94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   94.986329] Call Trace:\n[   94.986341]  \u003cTASK\u003e\n[   94.986347]  dump_stack_lvl+0x5e/0x80\n[   94.986374]  print_report+0xc8/0x270\n[   94.986384]  ? aa_dfa_match+0x5ae/0x760\n[   94.986388]  kasan_report+0x118/0x150\n[   94.986401]  ? aa_dfa_match+0x5ae/0x760\n[   94.986405]  aa_dfa_match+0x5ae/0x760\n[   94.986408]  __aa_path_perm+0x131/0x400\n[   94.986418]  aa_path_perm+0x219/0x2f0\n[   94.986424]  apparmor_file_open+0x345/0x570\n[   94.986431]  security_file_open+0x5c/0x140\n[   94.986442]  do_dentry_open+0x2f6/0x1120\n[   94.986450]  vfs_open+0x38/0x2b0\n[   94.986453]  ? may_open+0x1e2/0x2b0\n[   94.986466]  path_openat+0x231b/0x2b30\n[   94.986469]  ? __x64_sys_openat+0xf8/0x130\n[   94.986477]  do_file_open+0x19d/0x360\n[   94.986487]  do_sys_openat2+0x98/0x100\n[   94.986491]  __x64_sys_openat+0xf8/0x130\n[   94.986499]  do_syscall_64+0x8e/0x660\n[   94.986515]  ? count_memcg_events+0x15f/0x3c0\n[   94.986526]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986540]  ? handle_mm_fault+0x1639/0x1ef0\n[   94.986551]  ? vma_start_read+0xf0/0x320\n[   94.986558]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986561]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986563]  ? fpregs_assert_state_consistent+0x50/0xe0\n[   94.986572]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986574]  ? arch_exit_to_user_mode_prepare+0x9/0xb0\n[   94.986587]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986588]  ? irqentry_exit+0x3c/0x590\n[   94.986595]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   94.986597] RIP: 0033:0x7fda4a79c3ea\n\nFix by extracting the character value before invoking match_char,\nensuring single evaluation per outer loop."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:17.660Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c7dc56d8b37eda1396feeec3ab1c7ecee5eae31b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f16f2e5936c0f5f0d11fdf10d2be3e47e7108e42"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fc94f16098213d01e56c97feed9b3ecf0147a37"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a184f7cbdeaad17e16dedf3c17d0cd622edfed8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b73c1dff8a9d7eeaebabf8097a5b2de192f40913"
        },
        {
          "url": "https://git.kernel.org/stable/c/0510d1ba0976f97f521feb2b75b0572ea5df3ceb"
        },
        {
          "url": "https://git.kernel.org/stable/c/383b7270faf42564f133134c2fc3c24bbae52615"
        },
        {
          "url": "https://git.kernel.org/stable/c/8756b68edae37ff546c02091989a4ceab3f20abd"
        }
      ],
      "title": "apparmor: fix side-effect bug in match_char() macro usage",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23406",
    "datePublished": "2026-04-01T08:36:36.460Z",
    "dateReserved": "2026-01-13T15:37:46.013Z",
    "dateUpdated": "2026-05-11T22:06:17.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "555829fd91eaf0711e369b0a92aecb0f0aa3281f",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "22094c996968a7c5b59cd3fc9fcbdfdd46d02fec",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "7c7cf05e0606f554c467e3a4dc49e2e578a755b4",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "76b4d36c5122866452d34d8f79985e191f9c3831",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "d352873bbefa7eb39995239d0b44ccdf8aaa79a4",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix missing bounds check on DEFAULT table in verify_dfa()\n\nThe verify_dfa() function only checks DEFAULT_TABLE bounds when the state\nis not differentially encoded.\n\nWhen the verification loop traverses the differential encoding chain,\nit reads k = DEFAULT_TABLE[j] and uses k as an array index without\nvalidation. A malformed DFA with DEFAULT_TABLE[j] \u003e= state_count,\ntherefore, causes both out-of-bounds reads and writes.\n\n[   57.179855] ==================================================================\n[   57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660\n[   57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993\n\n[   57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[   57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   57.181563] Call Trace:\n[   57.181572]  \u003cTASK\u003e\n[   57.181577]  dump_stack_lvl+0x5e/0x80\n[   57.181596]  print_report+0xc8/0x270\n[   57.181605]  ? verify_dfa+0x59a/0x660\n[   57.181608]  kasan_report+0x118/0x150\n[   57.181620]  ? verify_dfa+0x59a/0x660\n[   57.181623]  verify_dfa+0x59a/0x660\n[   57.181627]  aa_dfa_unpack+0x1610/0x1740\n[   57.181629]  ? __kmalloc_cache_noprof+0x1d0/0x470\n[   57.181640]  unpack_pdb+0x86d/0x46b0\n[   57.181647]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181653]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181656]  ? aa_unpack_nameX+0x1a8/0x300\n[   57.181659]  aa_unpack+0x20b0/0x4c30\n[   57.181662]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181664]  ? stack_depot_save_flags+0x33/0x700\n[   57.181681]  ? kasan_save_track+0x4f/0x80\n[   57.181683]  ? kasan_save_track+0x3e/0x80\n[   57.181686]  ? __kasan_kmalloc+0x93/0xb0\n[   57.181688]  ? __kvmalloc_node_noprof+0x44a/0x780\n[   57.181693]  ? aa_simple_write_to_buffer+0x54/0x130\n[   57.181697]  ? policy_update+0x154/0x330\n[   57.181704]  aa_replace_profiles+0x15a/0x1dd0\n[   57.181707]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181710]  ? __kvmalloc_node_noprof+0x44a/0x780\n[   57.181712]  ? aa_loaddata_alloc+0x77/0x140\n[   57.181715]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181717]  ? _copy_from_user+0x2a/0x70\n[   57.181730]  policy_update+0x17a/0x330\n[   57.181733]  profile_replace+0x153/0x1a0\n[   57.181735]  ? rw_verify_area+0x93/0x2d0\n[   57.181740]  vfs_write+0x235/0xab0\n[   57.181745]  ksys_write+0xb0/0x170\n[   57.181748]  do_syscall_64+0x8e/0x660\n[   57.181762]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   57.181765] RIP: 0033:0x7f6192792eb2\n\nRemove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE\nentries unconditionally."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:18.806Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/555829fd91eaf0711e369b0a92aecb0f0aa3281f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/22094c996968a7c5b59cd3fc9fcbdfdd46d02fec"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c7cf05e0606f554c467e3a4dc49e2e578a755b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/76b4d36c5122866452d34d8f79985e191f9c3831"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/d352873bbefa7eb39995239d0b44ccdf8aaa79a4"
        }
      ],
      "title": "apparmor: fix missing bounds check on DEFAULT table in verify_dfa()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23407",
    "datePublished": "2026-04-01T08:36:37.197Z",
    "dateReserved": "2026-01-13T15:37:46.013Z",
    "dateUpdated": "2026-05-11T22:06:18.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c6347a2116ecccb8fd9ee4ebc75ae41d1d7ef689",
              "status": "affected",
              "version": "145a0ef21c8e944957f58e2c8ffcd8a10f46266a",
              "versionType": "git"
            },
            {
              "lessThan": "c053ae381ce227577567d1ef10090ce7506d7a28",
              "status": "affected",
              "version": "145a0ef21c8e944957f58e2c8ffcd8a10f46266a",
              "versionType": "git"
            },
            {
              "lessThan": "35f4caec1352054b9a61cfdf2bf1898073637aa0",
              "status": "affected",
              "version": "145a0ef21c8e944957f58e2c8ffcd8a10f46266a",
              "versionType": "git"
            },
            {
              "lessThan": "55ef2af7490aaf72f8ffe11ec44c6bcb7eb2162a",
              "status": "affected",
              "version": "145a0ef21c8e944957f58e2c8ffcd8a10f46266a",
              "versionType": "git"
            },
            {
              "lessThan": "86feeccd6b93ed94bd6655f30de80f163f8d5a45",
              "status": "affected",
              "version": "145a0ef21c8e944957f58e2c8ffcd8a10f46266a",
              "versionType": "git"
            },
            {
              "lessThan": "7998ab3010d2317643f91828f1853d954ef31387",
              "status": "affected",
              "version": "145a0ef21c8e944957f58e2c8ffcd8a10f46266a",
              "versionType": "git"
            },
            {
              "lessThan": "18b5233e860c294a847ee07869d93c0b8673a54b",
              "status": "affected",
              "version": "145a0ef21c8e944957f58e2c8ffcd8a10f46266a",
              "versionType": "git"
            },
            {
              "lessThan": "5df0c44e8f5f619d3beb871207aded7c78414502",
              "status": "affected",
              "version": "145a0ef21c8e944957f58e2c8ffcd8a10f46266a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: Fix double free of ns_name in aa_replace_profiles()\n\nif ns_name is NULL after\n1071         error = aa_unpack(udata, \u0026lh, \u0026ns_name);\n\nand if ent-\u003ens_name contains an ns_name in\n1089                 } else if (ent-\u003ens_name) {\n\nthen ns_name is assigned the ent-\u003ens_name\n1095                         ns_name = ent-\u003ens_name;\n\nhowever ent-\u003ens_name is freed at\n1262                 aa_load_ent_free(ent);\n\nand then again when freeing ns_name at\n1270         kfree(ns_name);\n\nFix this by NULLing out ent-\u003ens_name after it is transferred to ns_name\n\n\")"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:19.995Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c6347a2116ecccb8fd9ee4ebc75ae41d1d7ef689"
        },
        {
          "url": "https://git.kernel.org/stable/c/c053ae381ce227577567d1ef10090ce7506d7a28"
        },
        {
          "url": "https://git.kernel.org/stable/c/35f4caec1352054b9a61cfdf2bf1898073637aa0"
        },
        {
          "url": "https://git.kernel.org/stable/c/55ef2af7490aaf72f8ffe11ec44c6bcb7eb2162a"
        },
        {
          "url": "https://git.kernel.org/stable/c/86feeccd6b93ed94bd6655f30de80f163f8d5a45"
        },
        {
          "url": "https://git.kernel.org/stable/c/7998ab3010d2317643f91828f1853d954ef31387"
        },
        {
          "url": "https://git.kernel.org/stable/c/18b5233e860c294a847ee07869d93c0b8673a54b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5df0c44e8f5f619d3beb871207aded7c78414502"
        }
      ],
      "title": "apparmor: Fix double free of ns_name in aa_replace_profiles()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23408",
    "datePublished": "2026-04-01T08:36:37.873Z",
    "dateReserved": "2026-01-13T15:37:46.013Z",
    "dateUpdated": "2026-05-11T22:06:19.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/match.h",
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ff7c73744fafe944ed9a7b2b7cf6c8d5557a3d84",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "1439150cd3c411228b387ab5efca92199d2a659a",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "0fab44285445e9012674396d5c1236a67da518e0",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "f90e3ecd9e1ed69f1a370f866ceed1f104f3ab4a",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "34fc60b125ed1d4eb002c76b0664bf0619492167",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "623a9d211bbbb031bb1cbdb38b23487648167f8a",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "1ff4857fac56ac5a90ee63b24db05fa5e91a45aa",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "39440b137546a3aa383cfdabc605fb73811b6093",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/match.h",
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix differential encoding verification\n\nDifferential encoding allows loops to be created if it is abused. To\nprevent this the unpack should verify that a diff-encode chain\nterminates.\n\nUnfortunately the differential encode verification had two bugs.\n\n1. it conflated states that had gone through check and already been\n   marked, with states that were currently being checked and marked.\n   This means that loops in the current chain being verified are treated\n   as a chain that has already been verified.\n\n2. the order bailout on already checked states compared current chain\n   check iterators j,k instead of using the outer loop iterator i.\n   Meaning a step backwards in states in the current chain verification\n   was being mistaken for moving to an already verified state.\n\nMove to a double mark scheme where already verified states get a\ndifferent mark, than the current chain being kept. This enables us\nto also drop the backwards verification check that was the cause of\nthe second error as any already verified state is already marked."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:21.118Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ff7c73744fafe944ed9a7b2b7cf6c8d5557a3d84"
        },
        {
          "url": "https://git.kernel.org/stable/c/1439150cd3c411228b387ab5efca92199d2a659a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fab44285445e9012674396d5c1236a67da518e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f90e3ecd9e1ed69f1a370f866ceed1f104f3ab4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/34fc60b125ed1d4eb002c76b0664bf0619492167"
        },
        {
          "url": "https://git.kernel.org/stable/c/623a9d211bbbb031bb1cbdb38b23487648167f8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ff4857fac56ac5a90ee63b24db05fa5e91a45aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/39440b137546a3aa383cfdabc605fb73811b6093"
        }
      ],
      "title": "apparmor: fix differential encoding verification",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23409",
    "datePublished": "2026-04-01T08:36:38.516Z",
    "dateReserved": "2026-01-13T15:37:46.013Z",
    "dateUpdated": "2026-05-11T22:06:21.118Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/apparmorfs.c",
            "security/apparmor/include/policy_unpack.h",
            "security/apparmor/policy.c",
            "security/apparmor/policy_unpack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b8e77c7abab40e6de9ad9de730d77984a498840",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "d9d8560b9b7932f8cffc4c068c14289220900f79",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "6b6ba87579c7e7c669e0bec91823e7fb693bc5df",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "6ef1f2926c41ab96952d9696d55a052f1b3a9418",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "f9761add6d100962a23996cb68f3d6abdd4d1815",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "af782cc8871e3683ddd5a3cd2f7df526599863a9",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "763e838adc3c7ec5a7df2990ce84cad951e42721",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            },
            {
              "lessThan": "a0b7091c4de45a7325c8780e6934a894f92ac86b",
              "status": "affected",
              "version": "5d5182cae40115c03933989473288e54afb39c7c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/apparmorfs.c",
            "security/apparmor/include/policy_unpack.h",
            "security/apparmor/policy.c",
            "security/apparmor/policy_unpack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix race on rawdata dereference\n\nThere is a race condition that leads to a use-after-free situation:\nbecause the rawdata inodes are not refcounted, an attacker can start\nopen()ing one of the rawdata files, and at the same time remove the\nlast reference to this rawdata (by removing the corresponding profile,\nfor example), which frees its struct aa_loaddata; as a result, when\nseq_rawdata_open() is reached, i_private is a dangling pointer and\nfreed memory is accessed.\n\nThe rawdata inodes weren\u0027t refcounted to avoid a circular refcount and\nwere supposed to be held by the profile rawdata reference.  However\nduring profile removal there is a window where the vfs and profile\ndestruction race, resulting in the use after free.\n\nFix this by moving to a double refcount scheme. Where the profile\nrefcount on rawdata is used to break the circular dependency. Allowing\nfor freeing of the rawdata once all inode references to the rawdata\nare put."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:22.297Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b8e77c7abab40e6de9ad9de730d77984a498840"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9d8560b9b7932f8cffc4c068c14289220900f79"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b6ba87579c7e7c669e0bec91823e7fb693bc5df"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ef1f2926c41ab96952d9696d55a052f1b3a9418"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9761add6d100962a23996cb68f3d6abdd4d1815"
        },
        {
          "url": "https://git.kernel.org/stable/c/af782cc8871e3683ddd5a3cd2f7df526599863a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/763e838adc3c7ec5a7df2990ce84cad951e42721"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0b7091c4de45a7325c8780e6934a894f92ac86b"
        }
      ],
      "title": "apparmor: fix race on rawdata dereference",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23410",
    "datePublished": "2026-04-01T08:36:39.202Z",
    "dateReserved": "2026-01-13T15:37:46.013Z",
    "dateUpdated": "2026-05-11T22:06:22.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}