U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. Vulnerabilities

CVE-2026-23411 Detail

Description

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the inode can aand does live beyond that point and it is possible that some of the fs call back functions will be invoked after the reference has been put, which results in a race between freeing the data and accessing it through the fs. While the rawdata/loaddata is the most likely candidate to fail the race, as it has the fewest references. If properly crafted it might be possible to trigger a race for the other types stored in i_private. Fix this by moving the put of i_private referenced data to the correct place which is during inode eviction.


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
https://git.kernel.org/stable/c/13bc2772414d68e94e273dea013181a986948ddf kernel.org Patch 
https://git.kernel.org/stable/c/2a732ed26fbd048e7925d227af8cf9ea43fb5cc9 kernel.org Patch 
https://git.kernel.org/stable/c/3ddb961d2929bbb3204a2bba21b5d8153cd3f7cc kernel.org Patch 
https://git.kernel.org/stable/c/667df93769c02ff581c77d2d8f162147e719c557 kernel.org Patch 
https://git.kernel.org/stable/c/8e135b8aee5a06c52a4347a5a6d51223c6f36ba3 kernel.org Patch 
https://git.kernel.org/stable/c/a92c5e5086a87d082696245a8607666da3d80554 kernel.org Patch 
https://git.kernel.org/stable/c/ae10787d955fb255d381e0d5589451dd72c614b1 kernel.org Patch 
https://git.kernel.org/stable/c/eecce026399917f6efa532c56bc7a3e9dd6ee68b kernel.org Patch 

Weakness Enumeration

CWE-ID CWE Name Source
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') cwe source acceptance level NIST  

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

4 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2026-23411
NVD Published Date:
04/01/2026
NVD Last Modified:
04/24/2026
Source:
kernel.org