CVE-2026-23410 | Linux Kernel up to 6.6.129/6.12.76/6.18.17/6.19.7/7.0-rc3 apparmor use after free

VDB-354626 · CVE-2026-23410 · GCVE-0-2026-23410 LINUX KERNEL UP TO 6.6.129/6.12.76/6.18.17/6.19.7/7.0-RC3 APPARMOR USE AFTER FREE HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 7.6 $5k-$25k 2.57+ Summaryinfo A vulnerability was found in Linux Kernel up to 6.6.129/6.12.76/6.18.17/6.19.7/7.0-rc3. It has been declared as critical. This affects an unknown function of the component apparmor. Such manipulation leads to use after free. This vulnerability is documented as CVE-2026-23410. There is not any exploit available. It is recommended to upgrade the affected component. Detailsinfo A vulnerability was found in Linux Kernel up to 6.6.129/6.12.76/6.18.17/6.19.7/7.0-rc3. It has been rated as critical. Affected by this issue is some unknown processing of the component apparmor. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. CVE summarizes: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata dereference There is a race condition that leads to a use-after-free situation: because the rawdata inodes are not refcounted, an attacker can start open()ing one of the rawdata files, and at the same time remove the last reference to this rawdata (by removing the corresponding profile, for example), which frees its struct aa_loaddata; as a result, when seq_rawdata_open() is reached, i_private is a dangling pointer and freed memory is accessed. The rawdata inodes weren't refcounted to avoid a circular refcount and were supposed to be held by the profile rawdata reference. However during profile removal there is a window where the vfs and profile destruction race, resulting in the use after free. Fix this by moving to a double refcount scheme. Where the profile refcount on rawdata is used to break the circular dependency. Allowing for freeing of the rawdata once all inode references to the rawdata are put. The advisory is available at git.kernel.org. This vulnerability is handled as CVE-2026-23410 since 01/13/2026. The exploitation is known to be easy. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 04/01/2026). Upgrading to version 6.6.130, 6.12.77, 6.18.18, 6.19.8 or 7.0-rc4 eliminates this vulnerability. Applying the patch 6ef1f2926c41ab96952d9696d55a052f1b3a9418/f9761add6d100962a23996cb68f3d6abdd4d1815/af782cc8871e3683ddd5a3cd2f7df526599863a9/763e838adc3c7ec5a7df2990ce84cad951e42721/a0b7091c4de45a7325c8780e6934a894f92ac86b is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version. Productinfo Type Operating System Vendor Linux Name Kernel Version 6.6.129 6.12.0 6.12.1 6.12.2 6.12.3 6.12.4 6.12.5 6.12.6 6.12.7 6.12.8 6.12.9 6.12.10 6.12.11 6.12.12 6.12.13 6.12.14 6.12.15 6.12.16 6.12.17 6.12.18 6.12.19 6.12.20 6.12.21 6.12.22 6.12.23 6.12.24 6.12.25 6.12.26 6.12.27 6.12.28 6.12.29 6.12.30 6.12.31 6.12.32 6.12.33 6.12.34 6.12.35 6.12.36 6.12.37 6.12.38 6.12.39 6.12.40 6.12.41 6.12.42 6.12.43 6.12.44 6.12.45 6.12.46 6.12.47 6.12.48 6.12.49 6.12.50 6.12.51 6.12.52 6.12.53 6.12.54 6.12.55 6.12.56 6.12.57 6.12.58 6.12.59 6.12.60 6.12.61 6.12.62 6.12.63 6.12.64 6.12.65 6.12.66 6.12.67 6.12.68 6.12.69 6.12.70 6.12.71 6.12.72 6.12.73 6.12.74 6.12.75 6.12.76 6.18.0 6.18.1 6.18.2 6.18.3 6.18.4 6.18.5 6.18.6 6.18.7 6.18.8 6.18.9 6.18.10 6.18.11 6.18.12 6.18.13 6.18.14 6.18.15 6.18.16 6.18.17 6.19.0 6.19.1 6.19.2 6.19.3 6.19.4 6.19.5 6.19.6 6.19.7 7.0-rc1 7.0-rc2 7.0-rc3 License open-source Website Vendor: https://www.kernel.org/ CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 8.0 VulDB Meta Temp Score: 7.6 VulDB Base Score: 8.0 VulDB Temp Score: 7.6 VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Use after free CWE: CWE-416 / CWE-119 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Partially Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: Kernel 6.6.130/6.12.77/6.18.18/6.19.8/7.0-rc4 Patch: 6ef1f2926c41ab96952d9696d55a052f1b3a9418/f9761add6d100962a23996cb68f3d6abdd4d1815/af782cc8871e3683ddd5a3cd2f7df526599863a9/763e838adc3c7ec5a7df2990ce84cad951e42721/a0b7091c4de45a7325c8780e6934a894f92ac86b Timelineinfo 01/13/2026 CVE reserved 04/01/2026 +77 days Advisory disclosed 04/01/2026 +0 days VulDB entry created 04/01/2026 +0 days VulDB entry last update Sourcesinfo Vendor: kernel.org Advisory: git.kernel.org Status: Confirmed CVE: CVE-2026-23410 (🔒) GCVE (CVE): GCVE-0-2026-23410 GCVE (VulDB): GCVE-100-354626 Entryinfo Created: 04/01/2026 11:26 Changes: 04/01/2026 11:26 (58) Complete: 🔍 Cache ID: 99:F00:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸