Use-After-Free Vulnerability in Linux Kernel Affecting AppArmor

CVE-2026-23410

What is CVE-2026-23410?

A use-after-free vulnerability exists in the Linux kernel's AppArmor due to a race condition involving rawdata inodes. When an attacker opens a rawdata file while simultaneously removing the last reference to it (such as by removing the corresponding profile), it can lead to accessing freed memory. This flaw occurs because the rawdata inodes are not refcounted, aiming to avoid circular references. The vulnerability allows for unsafe memory access when the seq_rawdata_open() function is executed, resulting in serious implications for system integrity and security. The issue has been addressed by implementing a double refcounting scheme for rawdata, enabling safe memory management.

References