CVE-2026-23403

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix memory leak in verify_header

The function sets `*ns = NULL` on every call, leaking the namespace string allocated in previous iterations when multiple profiles are unpacked. This also breaks namespace consistency checking since *ns is always NULL when the comparison is made.

Remove the incorrect assignment. The caller (aa_unpack) initializes *ns to NULL once before the loop, which is sufficient.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

No affected versions have been published.

Timeline

Published
Apr 1, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-234045.5In the Linux kernel, the following vulnerability has been resolved: apparmor: replace recursive profile removal with iterative approach ThCVE-2026-234055.5In the Linux kernel, the following vulnerability has been resolved: apparmor: fix: limit the number of levels of policy namespaces CurrentCVE-2026-234067.8In the Linux kernel, the following vulnerability has been resolved: apparmor: fix side-effect bug in match_char() macro usage The match_chCVE-2026-234077.8In the Linux kernel, the following vulnerability has been resolved: apparmor: fix missing bounds check on DEFAULT table in verify_dfa() ThCVE-2026-234087.8In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix double free of ns_name in aa_replace_profiles() if ns_naCVE-2026-234095.5In the Linux kernel, the following vulnerability has been resolved: apparmor: fix differential encoding verification Differential encodingCVE-2026-234107.8In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata dereference There is a race condition thCVE-2026-234117.8In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor wCVE-2026-234127.8In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: defer hook memory release until rcu readers are done YCVE-2026-234137.8In the Linux kernel, the following vulnerability has been resolved: clsact: Fix use-after-free in init/destroy rollback asymmetry Fix a usCVE-2026-234145.5In the Linux kernel, the following vulnerability has been resolved: tls: Purge async_hold in tls_decrypt_async_wait() The async_hold queueCVE-2026-234157.8In the Linux kernel, the following vulnerability has been resolved: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
CVE-2026-23403: Medium severity, CVSS 5.5 | Vulnix