Linux Kernel AppArmor: Race on i_private during Inode Eviction
CVE-2026-23411 Published on April 1, 2026
apparmor: fix race between freeing data and fs accessing it
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix race between freeing data and fs accessing it
AppArmor was putting the reference to i_private data on its end after
removing the original entry from the file system. However the inode
can aand does live beyond that point and it is possible that some of
the fs call back functions will be invoked after the reference has
been put, which results in a race between freeing the data and
accessing it through the fs.
While the rawdata/loaddata is the most likely candidate to fail the
race, as it has the fewest references. If properly crafted it might be
possible to trigger a race for the other types stored in i_private.
Fix this by moving the put of i_private referenced data to the correct
place which is during inode eviction.
Products Associated with CVE-2026-23411
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version c961ee5f21b202dea60b63eeef945730d92e46a6 and below ae10787d955fb255d381e0d5589451dd72c614b1 is affected.
- Version c961ee5f21b202dea60b63eeef945730d92e46a6 and below eecce026399917f6efa532c56bc7a3e9dd6ee68b is affected.
- Version c961ee5f21b202dea60b63eeef945730d92e46a6 and below 13bc2772414d68e94e273dea013181a986948ddf is affected.
- Version c961ee5f21b202dea60b63eeef945730d92e46a6 and below 2a732ed26fbd048e7925d227af8cf9ea43fb5cc9 is affected.
- Version c961ee5f21b202dea60b63eeef945730d92e46a6 and below 8e135b8aee5a06c52a4347a5a6d51223c6f36ba3 is affected.
- Version 4.13 is affected.
- Before 4.13 is unaffected.
- Version 6.6.130, <= 6.6.* is unaffected.
- Version 6.12.77, <= 6.12.* is unaffected.
- Version 6.18.18, <= 6.18.* is unaffected.
- Version 6.19.8, <= 6.19.* is unaffected.
- Version 7.0-rc4, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.