Vulnerability in Linux

CVE-2026-23411

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the inode can aand does live beyond that point and it is possible that some of the fs call back functions will be invoked after the reference has been put, which results in a race between freeing the data and accessing it through the fs. While the rawdata/loaddata is the most likely candidate to fail the race, as it has the fewest references. If properly crafted it might be possible to trigger a race for the other types stored in i_private. Fix this by moving the put of i_private referenced data to the correct place which is during inode eviction.

Vulnerability class: Race Condition

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.001 (3.2th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 3rd percentile — 3.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-23411: held from 0.001 to 0.001.

EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: 0.000

Affected products

  • Linux — versions c961ee5f21b202dea60b63eeef945730d92e46a6, 4.13, 0
  • Linux Kernel — versions 4.13, 7.0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-23411?
CVE-2026-23411 is a high-severity vulnerability in Linux, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 7.8/10. Published 2026-04-01.
How severe is CVE-2026-23411?
High severity. CVSS v3 base score is 7.8 out of 10.