Bug 2453789 (CVE-2026-23411)

Summary: CVE-2026-23411 kernel: apparmor: fix race between freeing data and fs accessing it
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's AppArmor security module. A race condition occurs when AppArmor incorrectly manages the lifecycle of `i_private` data, leading to situations where data is freed while still being accessed by file system callback functions. This timing vulnerability can result in memory corruption. A local attacker could potentially exploit this flaw to cause a denial of service or, with further exploitation, achieve more severe impacts.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-01 10:01:39 UTC 
In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix race between freeing data and fs accessing it

AppArmor was putting the reference to i_private data on its end after
removing the original entry from the file system. However the inode
can aand does live beyond that point and it is possible that some of
the fs call back functions will be invoked after the reference has
been put, which results in a race between freeing the data and
accessing it through the fs.

While the rawdata/loaddata is the most likely candidate to fail the
race, as it has the fewest references. If properly crafted it might be
possible to trigger a race for the other types stored in i_private.

Fix this by moving the put of i_private referenced data to the correct
place which is during inode eviction.
Comment 1 Alexander B 2026-04-01 10:55:22 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026040114-CVE-2026-23411-00f7@gregkh/T