CVE-2026-23411

apparmor: fix race between freeing data and fs accessing it

State: Published
Severity: 7.8 High
Published: Apr 1, 2026
Updated: Aug 5, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix race between freeing data and fs accessing it

AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the inode can aand does live beyond that point and it is possible that some of the fs call back functions will be invoked after the reference has been put, which results in a race between freeing the data and accessing it through the fs.

While the rawdata/loaddata is the most likely candidate to fail the race, as it has the fewest references. If properly crafted it might be possible to trigger a race for the other types stored in i_private.

Fix this by moving the put of i_private referenced data to the correct place which is during inode eviction.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c961ee5f21b202dea60b63eeef945730d92e46a6 to before a92c5e5086a87d082696245a8607666da3d80554Affected c961ee5f21b202dea60b63eeef945730d92e46a6 to before 667df93769c02ff581c77d2d8f162147e719c557Affected c961ee5f21b202dea60b63eeef945730d92e46a6 to before 3ddb961d2929bbb3204a2bba21b5d8153cd3f7ccAffected c961ee5f21b202dea60b63eeef945730d92e46a6 to before ae10787d955fb255d381e0d5589451dd72c614b1Affected c961ee5f21b202dea60b63eeef945730d92e46a6 to before eecce026399917f6efa532c56bc7a3e9dd6ee68bAffected c961ee5f21b202dea60b63eeef945730d92e46a6 to before 13bc2772414d68e94e273dea013181a986948ddfAffected c961ee5f21b202dea60b63eeef945730d92e46a6 to before 2a732ed26fbd048e7925d227af8cf9ea43fb5cc9Affected c961ee5f21b202dea60b63eeef945730d92e46a6 to before 8e135b8aee5a06c52a4347a5a6d51223c6f36ba3Affected
LinuxLinux	4.13Affected before 4.13Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.169 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.77 through 6.12.Not affected 6.18.18 through 6.18.Not affected 6.19.8 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

c961ee5f21b202dea60b63eeef945730d92e46a6 to before a92c5e5086a87d082696245a8607666da3d80554Affected
c961ee5f21b202dea60b63eeef945730d92e46a6 to before 667df93769c02ff581c77d2d8f162147e719c557Affected
c961ee5f21b202dea60b63eeef945730d92e46a6 to before 3ddb961d2929bbb3204a2bba21b5d8153cd3f7ccAffected
c961ee5f21b202dea60b63eeef945730d92e46a6 to before ae10787d955fb255d381e0d5589451dd72c614b1Affected
c961ee5f21b202dea60b63eeef945730d92e46a6 to before eecce026399917f6efa532c56bc7a3e9dd6ee68bAffected
c961ee5f21b202dea60b63eeef945730d92e46a6 to before 13bc2772414d68e94e273dea013181a986948ddfAffected
c961ee5f21b202dea60b63eeef945730d92e46a6 to before 2a732ed26fbd048e7925d227af8cf9ea43fb5cc9Affected
c961ee5f21b202dea60b63eeef945730d92e46a6 to before 8e135b8aee5a06c52a4347a5a6d51223c6f36ba3Affected

LinuxLinux

4.13Affected
before 4.13Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.169 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.77 through 6.12.*Not affected
6.18.18 through 6.18.*Not affected
6.19.8 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.