CVE-2026-23408
published 2026-04-01CVE-2026-23408: In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix double free of ns_name in aa_replace_profiles() if ns_name is NULL after 1071…
PriorityP336high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.18%
8.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
apparmor: Fix double free of ns_name in aa_replace_profiles()
if ns_name is NULL after
1071 error = aa_unpack(udata, &lh, &ns_name);
and if ent->ns_name contains an ns_name in
1089 } else if (ent->ns_name) {
then ns_name is assigned the ent->ns_name
1095 ns_name = ent->ns_name;
however ent->ns_name is freed at
1262 aa_load_ent_free(ent);
and then again when freeing ns_name at
1270 kfree(ns_name);
Fix this by NULLing out ent->ns_name after it is transferred to ns_name
")
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.164-1 (bookworm) | linux 6.1.164-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 145a0ef21c8e944957f58e2c8ffcd8a10f46266a < c6347a2116ecccb8fd9ee4ebc75ae41d1d7ef689 | c6347a2116ecccb8fd9ee4ebc75ae41d1d7ef689 |
| linux | linux | >= 145a0ef21c8e944957f58e2c8ffcd8a10f46266a < c053ae381ce227577567d1ef10090ce7506d7a28 | c053ae381ce227577567d1ef10090ce7506d7a28 |
| linux | linux | >= 145a0ef21c8e944957f58e2c8ffcd8a10f46266a < 35f4caec1352054b9a61cfdf2bf1898073637aa0 | 35f4caec1352054b9a61cfdf2bf1898073637aa0 |
| linux | linux | >= 145a0ef21c8e944957f58e2c8ffcd8a10f46266a < 55ef2af7490aaf72f8ffe11ec44c6bcb7eb2162a | 55ef2af7490aaf72f8ffe11ec44c6bcb7eb2162a |
| linux | linux | >= 145a0ef21c8e944957f58e2c8ffcd8a10f46266a < 86feeccd6b93ed94bd6655f30de80f163f8d5a45 | 86feeccd6b93ed94bd6655f30de80f163f8d5a45 |
| linux | linux | >= 145a0ef21c8e944957f58e2c8ffcd8a10f46266a < 7998ab3010d2317643f91828f1853d954ef31387 | 7998ab3010d2317643f91828f1853d954ef31387 |
| linux | linux | >= 145a0ef21c8e944957f58e2c8ffcd8a10f46266a < 18b5233e860c294a847ee07869d93c0b8673a54b | 18b5233e860c294a847ee07869d93c0b8673a54b |
| linux | linux | >= 145a0ef21c8e944957f58e2c8ffcd8a10f46266a < 5df0c44e8f5f619d3beb871207aded7c78414502 | 5df0c44e8f5f619d3beb871207aded7c78414502 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.251-1 | 5.10.251-1 |
| linux | linux_kernel | >= 0 < 6.1.164-1 | 6.1.164-1 |
| linux | linux_kernel | >= 0 < 6.12.74-2 | 6.12.74-2 |
| linux | linux_kernel | >= 0 < 6.19.6-2 | 6.19.6-2 |
| linux | linux_kernel | >= 5.11 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.169 | 6.1.169 |
| linux | linux_kernel | >= 5.5.1 < 5.10.253 | 5.10.253 |
| linux | linux_kernel | >= 6.13 < 6.18.18 | 6.18.18 |
| linux | linux_kernel | >= 6.19 < 6.19.8 | 6.19.8 |
| linux | linux_kernel | >= 6.2 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 6.7 < 6.12.77 | 6.12.77 |
| ubuntu | linux-azure-5.15 | — | — |
| ubuntu | linux-azure-5.4 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Xilinx) vulnerabilities
vendor_ubuntu·2026-05-07·CVSS 6.4
CVE-2025-68288 [MEDIUM] Linux kernel (Xilinx) vulnerabilities
Title: Linux kernel (Xilinx) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo
Rizzo discovered that some AMD Zen processors did not properly verify the
signature of CPU microcode. This flaw is known as EntrySign. A privileged
attacker could possibly use this issue to cause load malicious CPU
microcode causing loss of integrity and confidentiality. (CVE-2024-36347)
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation,
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-05-07·CVSS 7.8
CVE-2025-22058 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corre
Ubuntu
Linux kernel (BlueField) vulnerabilities
vendor_ubuntu·2026-04-29·CVSS 4.7
CVE-2022-48875 [MEDIUM] Linux kernel (BlueField) vulnerabilities
Title: Linux kernel (BlueField) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update c
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-04-22·CVSS 4.7
CVE-2026-23410 [MEDIUM] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corre
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-04-13·CVSS 7.8
CVE-2024-53114 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corre
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities
vendor_ubuntu·2026-04-09·CVSS 7.8
CVE-2025-21833 [HIGH] Linux kernel (Azure FIPS) vulnerabilities
Title: Linux kernel (Azure FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities
vendor_ubuntu·2026-04-09·CVSS 7.8
CVE-2025-71125 [HIGH] Linux kernel (Azure FIPS) vulnerabilities
Title: Linux kernel (Azure FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update
Ubuntu
Linux kernel (Intel IoTG Real-time) vulnerabilities
vendor_ubuntu·2026-04-09·CVSS 7.8
CVE-2026-23410 [HIGH] Linux kernel (Intel IoTG Real-time) vulnerabilities
Title: Linux kernel (Intel IoTG Real-time) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
Th
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-04-06·CVSS 7.2
CVE-2026-23404 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibl
Red Hat
kernel: apparmor: Fix double free of ns_name in aa_replace_profiles()
vendor_redhat·2026-04-01·CVSS 7.8
CVE-2026-23408 [HIGH] CWE-1341 kernel: apparmor: Fix double free of ns_name in aa_replace_profiles()
kernel: apparmor: Fix double free of ns_name in aa_replace_profiles()
In the Linux kernel, the following vulnerability has been resolved:
apparmor: Fix double free of ns_name in aa_replace_profiles()
if ns_name is NULL after
1071 error = aa_unpack(udata, &lh, &ns_name);
and if ent->ns_name contains an ns_name in
1089 } else if (ent->ns_name) {
then ns_name is assigned the ent->ns_name
1095 ns_name = ent->ns_name;
however ent->ns_name is freed at
1262 aa_load_ent_free(ent);
and then again when freeing ns_name at
1270 kfree(ns_name);
Fix this by NULLing out ent->ns_name after it is transferred to ns_name
")
A flaw was found in AppArmor within the Linux kernel. This vulnerability involves a double free of the `ns_name` variable in the `aa_replace_profiles()` function. This can occur when `n
Debian
CVE-2026-23408: linux - In the Linux kernel, the following vulnerability has been resolved: apparmor: F...
vendor_debian·2026·CVSS 7.8
CVE-2026-23408 [HIGH] CVE-2026-23408: linux - In the Linux kernel, the following vulnerability has been resolved: apparmor: F...
In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix double free of ns_name in aa_replace_profiles() if ns_name is NULL after 1071 error = aa_unpack(udata, &lh, &ns_name); and if ent->ns_name contains an ns_name in 1089 } else if (ent->ns_name) { then ns_name is assigned the ent->ns_name 1095 ns_name = ent->ns_name; however ent->ns_name is freed at 1262 aa_load_ent_free(ent); and then again when freeing ns_name at 1270 kfree(ns_name); Fix this by NULLing out ent->ns_name after it is transferred to ns_name ")
Scope: local
bookworm: resolved (fixed in 6.1.164-1)
bullseye: resolved (fixed in 5.10.251-1)
forky: resolved (fixed in 6.19.6-2)
sid: resolved (fixed in 6.19.6-2)
trixie: resolved (fixed in 6.12.74-2)
VulDB
Linux Kernel up to 7.0-rc3 apparmor aa_replace_profiles double free (EUVD-2026-17837 / WID-SEC-2026-0950)
vuldb·2026-04-19·CVSS 7.8
CVE-2026-23408 [HIGH] Linux Kernel up to 7.0-rc3 apparmor aa_replace_profiles double free (EUVD-2026-17837 / WID-SEC-2026-0950)
A vulnerability has been found in Linux Kernel up to 6.6.129/6.12.76/6.18.17/6.19.7/7.0-rc3 and classified as critical. Impacted is the function aa_replace_profiles of the component apparmor. The manipulation leads to double free.
This vulnerability is listed as CVE-2026-23408. The attack must be carried out from within the local network. There is no available exploit.
The affected component should be upgraded.
OSV
linux-oem-6.17 vulnerabilities
osv·2026-04-06·CVSS 7.2
CVE-2025-62626 [HIGH] linux-oem-6.17 vulnerabilities
linux-oem-6.17 vulnerabilities
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026
GHSA
GHSA-qcx9-4fj7-jf29: In the Linux kernel, the following vulnerability has been resolved:
apparmor: Fix double free of ns_name in aa_replace_profiles()
if ns_name is NULL
ghsa_unreviewed·2026-04-01
CVE-2026-23408 [HIGH] GHSA-qcx9-4fj7-jf29: In the Linux kernel, the following vulnerability has been resolved:
apparmor: Fix double free of ns_name in aa_replace_profiles()
if ns_name is NULL
In the Linux kernel, the following vulnerability has been resolved:
apparmor: Fix double free of ns_name in aa_replace_profiles()
if ns_name is NULL after
1071 error = aa_unpack(udata, &lh, &ns_name);
and if ent->ns_name contains an ns_name in
1089 } else if (ent->ns_name) {
then ns_name is assigned the ent->ns_name
1095 ns_name = ent->ns_name;
however ent->ns_name is freed at
1262 aa_load_ent_free(ent);
and then again when freeing ns_name at
1270 kfree(ns_name);
Fix this by NULLing out ent->ns_name after it is transferred to ns_name
")
OSV
CVE-2026-23408: In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix double free of ns_name in aa_replace_profiles() if ns_name is NULL a
osv·2026-04-01·CVSS 7.8
CVE-2026-23408 [HIGH] CVE-2026-23408: In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix double free of ns_name in aa_replace_profiles() if ns_name is NULL a
In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix double free of ns_name in aa_replace_profiles() if ns_name is NULL after 1071 error = aa_unpack(udata, &lh, &ns_name); and if ent->ns_name contains an ns_name in 1089 } else if (ent->ns_name) { then ns_name is assigned the ent->ns_name 1095 ns_name = ent->ns_name; however ent->ns_name is freed at 1262 aa_load_ent_free(ent); and then again when freeing ns_name at 1270 kfree(ns_name); Fix this by NULLing out ent->ns_name after it is transferred to ns_name ")
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/18b5233e860c294a847ee07869d93c0b8673a54bhttps://git.kernel.org/stable/c/35f4caec1352054b9a61cfdf2bf1898073637aa0https://git.kernel.org/stable/c/55ef2af7490aaf72f8ffe11ec44c6bcb7eb2162ahttps://git.kernel.org/stable/c/5df0c44e8f5f619d3beb871207aded7c78414502https://git.kernel.org/stable/c/7998ab3010d2317643f91828f1853d954ef31387https://git.kernel.org/stable/c/86feeccd6b93ed94bd6655f30de80f163f8d5a45https://git.kernel.org/stable/c/c053ae381ce227577567d1ef10090ce7506d7a28https://git.kernel.org/stable/c/c6347a2116ecccb8fd9ee4ebc75ae41d1d7ef689
2026-04-01
Published