Security readout for executives and security teams
Plain-English summary
A Linux kernel AppArmor flaw can free the same namespace-name memory twice while replacing security profiles. The supplied assessment rates it high because a local, low-privileged attacker may trigger memory corruption affecting confidentiality, integrity, or availability. It is not described as remotely exploitable.
Executive priority
Treat this as a high-priority kernel update for AppArmor-enabled, multi-user, or shared Linux systems. It does not currently warrant emergency internet-facing incident assumptions because evidence supports a local attack path and no active exploitation. Accelerate normal patching and validate actual distribution exposure.
Technical view
In aa_replace_profiles(), ns_name may take ownership of ent->ns_name after aa_unpack() returns it as NULL. aa_load_ent_free(ent) then frees that pointer, followed by a second kfree(ns_name). The stable fix clears ent->ns_name after ownership transfer, preventing the double free.
Likely exposure
Exposure concerns Linux systems running affected kernels where AppArmor profile replacement is reachable. The supplied version data covers multiple kernel branches but has ambiguous boundaries, so kernel versions alone are insufficient. Distribution backports and AppArmor configuration must be checked.
Exploitation context
The CVSS 3.1 vector is 7.8: local access, low complexity, low privileges, and no user interaction, with potentially high impact. The bundle marks KEV false and cites no active exploitation or public proof of concept. Remote exploitation is not supported by the supplied evidence.
Researcher notes
The vulnerable condition is an ownership-transfer error involving ent->ns_name and ns_name in the AppArmor profile-loading path. The fix nulls the source pointer after transfer. No CWE, exploit artifact, attack prerequisite detail beyond the CVSS vector, or evidence of successful code execution is supplied; assess those points as unresolved.
Mitigation direction
- Install a vendor kernel containing the applicable stable fix or backport.
- Reboot into the updated kernel after installation.
- Prioritize multi-user systems where untrusted local access exists.
- Consult distribution guidance when package versions do not match upstream releases.
Validation and detection
- Inventory running kernel versions and determine whether AppArmor is enabled.
- Map distribution kernel packages to the cited upstream fixes or documented backports.
- Confirm the fixed kernel is running after reboot.
- Review kernel logs for AppArmor-related crashes or memory-corruption symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23408 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c6347a2116ecccb8fd9ee4ebc75ae41d1d7ef689CVE reference, Linux
- https://git.kernel.org/stable/c/c053ae381ce227577567d1ef10090ce7506d7a28CVE reference, Linux
- https://git.kernel.org/stable/c/35f4caec1352054b9a61cfdf2bf1898073637aa0CVE reference, Linux
- https://git.kernel.org/stable/c/55ef2af7490aaf72f8ffe11ec44c6bcb7eb2162aCVE reference, Linux
- https://git.kernel.org/stable/c/86feeccd6b93ed94bd6655f30de80f163f8d5a45CVE reference, Linux
- https://git.kernel.org/stable/c/7998ab3010d2317643f91828f1853d954ef31387CVE reference, Linux
- https://git.kernel.org/stable/c/18b5233e860c294a847ee07869d93c0b8673a54bCVE reference, Linux
- https://git.kernel.org/stable/c/5df0c44e8f5f619d3beb871207aded7c78414502CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.