Tracker / CVE-2026-23408
CVE-2026-23408
High 7.8
In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix double free of ns_name in aa_replace_profiles() if ns_name is NULL after 1071 error = aa_unpack(udata, &lh, &ns_name); and if ent->ns_name contains an ns_name in 1089 } else if (ent->ns_name) { then ns_name is assigned the ent->ns_name 1095 ns_name = ent->ns_name; however ent->ns_name is freed at 1262 aa_load_ent_free(ent); and then again when freeing ns_name at 1270 kfree(ns_name); Fix this by NULLing out ent->ns_name after it is transferred to ns_name ")
Affected products and versions
| linux | linux_kernel |
|---|---|
| linux | linux_kernel · 5.11 → 5.15.203 |
| linux | linux_kernel · 5.16 → 6.1.169 |
| linux | linux_kernel · 5.5.1 → 5.10.253 |
| linux | linux_kernel · 6.13 → 6.18.18 |
| linux | linux_kernel · 6.19 → 6.19.8 |
| linux | linux_kernel · 6.2 → 6.6.130 |
| linux | linux_kernel · 6.7 → 6.12.77 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.