PT-2026-29491 · Linux+2 · Linux Kernel+2

Published

2026-04-01

·

Updated

2026-05-07

·

CVE-2026-23408

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description The Linux kernel contains a flaw within the apparmor subsystem related to a double free of ns name in the aa replace profiles() function. Specifically, if ns name is NULL after unpacking user data, and ent->ns name contains an ns name, the ent->ns name is assigned to ns name. However, ent->ns name is freed, and then ns name is freed again, leading to a double free condition.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2026-23408
OESA-2026-1862
OESA-2026-1863
OESA-2026-1864
OESA-2026-1950
USN-8152-1
USN-8163-1
USN-8163-2
USN-8164-1
USN-8165-1
USN-8243-1
USN-8261-1

Affected Products

Linuxmint
Linux Kernel
Ubuntu