CVE-2026-23408: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23408 is a double free vulnerability in the Linux kernel's AppArmor security module, specifically within the aa_replace_profiles() function. The flaw was disclosed on April 1, 2026, and affects multiple Linux kernel stable branches: 5.5.x through 5.10.252, 5.11 through 5.15.202, 5.16 through 6.1.168, 6.2 through 6.6.129, 6.7 through 6.12.76, 6.13 through 6.18.17, and 6.19 through 6.19.7, as well as Linux kernel 7.0 release candidates up to rc7. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a double free memory error (CWE-415 / CWE-1341) in the aa_replace_profiles() function in the Linux kernel's AppArmor subsystem. When ns_name is initially NULL after aa_unpack() and is subsequently assigned the value of ent->ns_name, the pointer is freed twice: once when aa_load_ent_free(ent) releases the ent structure (and its ns_name member), and again when kfree(ns_name) is called at the end of the function. The attack vector is local (AV:L) with low privilege requirements (PR:L) and no user interaction needed. The fix involves nullifying ent->ns_name immediately after its value is transferred to ns_name, preventing the second free (GitHub Advisory).

Successful exploitation of this double free vulnerability can result in kernel memory corruption, potentially leading to a denial of service (kernel panic/crash) or arbitrary code execution with kernel-level privileges. An attacker with low-privileged local access who can invoke the aa_replace_profiles() function with specially crafted input could escalate privileges to root, compromising the full confidentiality, integrity, and availability of the affected system (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface compared to remotely exploitable vulnerabilities (GitHub Advisory, Red Hat Bugzilla).

Patches have been released across multiple Linux kernel stable branches. Administrators should upgrade to the following fixed versions or later: 5.10.253, 5.15.203, 6.1.169, 6.6.130, 6.12.77, 6.18.18, or 6.19.8. Fixes are also available for the 7.0 release candidate series (rc4 and later). Ubuntu has issued security notices USN-8152-1, USN-8163-1, USN-8163-2, USN-8201-1, USN-8224-1, and USN-8243-1 addressing this issue. SUSE has released advisories SUSE-SU-2026:2068-1, SUSE-SU-2026:2111-1, SUSE-SU-2026:2195-1, SUSE-SU-2026:2215-1, and SUSE-SU-2026:2238-1. As a compensating control, restricting local user privileges to minimize access to AppArmor profile replacement operations can reduce the attack surface (GitHub Advisory, Ubuntu USN-8152-1, SUSE Advisory).

Qualys published a blog post titled "CrackArmor: Critical AppArmor Flaws Enable Local Privilege Escalation to Root" in March 2026, which appears to cover this and related AppArmor vulnerabilities (Qualys Blog). The vulnerability was announced via the Linux kernel CVE mailing list and the oss-security mailing list shortly after disclosure. Multiple Linux distributions including Ubuntu, SUSE, and openSUSE have issued timely security advisories, reflecting standard industry response to kernel memory safety issues.