CVE-2026-23411 — Expired Pointer Dereference in Linux
Severity
7.8HIGHNVD
OSV7.2
EPSS
0.0%
top 97.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 1
Latest updateApr 13
Description
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix race between freeing data and fs accessing it
AppArmor was putting the reference to i_private data on its end after
removing the original entry from the file system. However the inode
can aand does live beyond that point and it is possible that some of
the fs call back functions will be invoked after the reference has
been put, which results in a race between freeing the data and
accessing it through the fs.
Whi…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages3 packages
▶CVEListV5linux/linuxc961ee5f21b202dea60b63eeef945730d92e46a6 — ae10787d955fb255d381e0d5589451dd72c614b1+5
🔴Vulnerability Details
4GHSA▶
GHSA-4g4x-f3f9-gpq4: In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix race between freeing data and fs accessing it
AppArmor was putting↗2026-04-01
OSV▶
CVE-2026-23411: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting t↗2026-04-01