CVE-2026-23410: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23410 is a use-after-free race condition vulnerability in the Linux kernel's AppArmor module, specifically in the handling of rawdata inode references. Because rawdata inodes are not refcounted, a local attacker can concurrently open a rawdata file while removing the last reference to that rawdata (e.g., by deleting the associated AppArmor profile), causing struct aa_loaddata to be freed while still in use; when seq_rawdata_open() is subsequently reached, i_private becomes a dangling pointer. The vulnerability was published on April 1, 2026, and affects the Linux kernel from version 4.13 through multiple stable branches up to 6.19.7. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is classified under CWE-911 (Improper Update of Reference Count) and CWE-362 (Race Condition / Concurrent Execution using Shared Resource with Improper Synchronization). Rawdata inodes in AppArmor's securityfs were intentionally not refcounted to avoid circular reference counting, relying instead on the profile's rawdata reference to keep them alive. However, a time-of-check/time-of-use (TOCTOU) window exists during profile removal: the VFS layer may still be processing an open() call on a rawdata file while the profile destruction path frees struct aa_loaddata, resulting in access to freed kernel memory via the dangling i_private pointer in seq_rawdata_open(). The fix introduces a double refcount scheme where the profile's refcount on rawdata is used to break the circular dependency, allowing rawdata to be freed only after all inode references are released (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows a local attacker with low privileges to trigger kernel use-after-free conditions, potentially leading to disclosure of sensitive kernel memory (high confidentiality impact), corruption of kernel state (high integrity impact), or system crashes (high availability impact). The vulnerability is confined to the local system scope, but kernel memory disclosure could expose credentials, cryptographic material, or other sensitive data, and kernel state corruption could be leveraged for local privilege escalation to root (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of this report (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, and the attacker must successfully win a race condition between concurrent VFS operations and profile destruction, adding practical complexity (GitHub Advisory).

1. Gain local access: Obtain a low-privilege shell on a target Linux system running an affected kernel version (4.13–5.10.252, 5.11–5.15.202, 5.16–6.1.168, 6.2–6.6.129, 6.7–6.12.76, 6.13–6.18.17, or 6.19–6.19.7) with AppArmor enabled.
2. Identify rawdata files: Locate AppArmor rawdata files in the securityfs, typically under /sys/kernel/security/apparmor/policy/profiles/<profile_name>/raw_data/.
3. Set up concurrent threads: Write a program or script that spawns two concurrent threads — one repeatedly calling open() on a rawdata file, and another repeatedly loading and removing an AppArmor profile (e.g., using apparmor_parser -r and apparmor_parser -R) to free the associated struct aa_loaddata.
4. Win the race: Time the profile removal to occur between the VFS inode lookup and the execution of seq_rawdata_open(), causing i_private to become a dangling pointer to freed memory.
5. Trigger use-after-free: When seq_rawdata_open() dereferences the freed struct aa_loaddata, the attacker can read freed kernel memory (for information disclosure) or, with additional heap manipulation, potentially redirect kernel execution flow for privilege escalation (GitHub Advisory, Feedly).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing use-after-free warnings, KASAN (Kernel Address Sanitizer) reports referencing seq_rawdata_open or aa_loaddata, or general protection fault (GPF) messages in AppArmor code paths.
• Process: Unusual processes repeatedly loading and removing AppArmor profiles in rapid succession (observable via auditd or ps); repeated open() syscalls targeting /sys/kernel/security/apparmor/policy/profiles/*/raw_data/ from a single low-privilege process.
• File System: Unexpected or repeated access to AppArmor securityfs rawdata files, particularly combined with concurrent profile manipulation activity.
• Kernel: System instability, unexpected kernel panics, or memory corruption errors correlated with AppArmor profile removal operations (GitHub Advisory, Feedly).

Patches are available across multiple stable kernel branches. Upgrade to one of the following fixed versions: 5.10.253, 5.15.203, 6.1.169, 6.6.130, 6.12.77, 6.18.18, 6.19.8, or the 7.0-rc4 development branch. Patches are available from the upstream kernel stable tree at git.kernel.org. Ubuntu has issued security notices USN-8152-1, USN-8163-1, USN-8163-2, USN-8201-1, USN-8224-1, USN-8243-1, USN-8266-1, and USN-8267-1; SUSE has released SUSE-SU-2026:2111-1, SUSE-SU-2026:2195-1, SUSE-SU-2026:2215-1, and SUSE-SU-2026:2238-1. As a temporary workaround for systems that cannot be immediately patched, restrict local user access to AppArmor securityfs interfaces and limit the ability of unprivileged users to load or remove AppArmor profiles (GitHub Advisory, Ubuntu USN-8152-1, SUSE Advisory).

Qualys published a blog post titled "CrackArmor: Critical AppArmor Flaws Enable Local Privilege Escalation to Root" covering this and related AppArmor vulnerabilities, drawing attention to the severity of the issue class (Qualys Blog). The vulnerability was announced via the Linux kernel CVE mailing list and the oss-security list shortly after disclosure. Multiple Linux distributions including Ubuntu and SUSE responded promptly with security advisories and patched kernel packages (Ubuntu USN-8152-1, SUSE Advisory).