CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2026-23411 – apparmor: fix race between freeing data and fs accessing it
https://notcve.org/view.php?id=CVE-2026-23411
01 Apr 2026 — In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the inode can aand does live beyond that point and it is possible that some of the fs call back functions will be invoked after the reference has been put, which results in a race between freeing the data and accessing it through the fs. While the rawdata/... • https://git.kernel.org/stable/c/c961ee5f21b202dea60b63eeef945730d92e46a6 •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2026-23410 – apparmor: fix race on rawdata dereference
https://notcve.org/view.php?id=CVE-2026-23410
01 Apr 2026 — In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata dereference There is a race condition that leads to a use-after-free situation: because the rawdata inodes are not refcounted, an attacker can start open()ing one of the rawdata files, and at the same time remove the last reference to this rawdata (by removing the corresponding profile, for example), which frees its struct aa_loaddata; as a result, when seq_rawdata_open() is reached, i_private is a dangling poi... • https://git.kernel.org/stable/c/5d5182cae40115c03933989473288e54afb39c7c •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2026-23405 – apparmor: fix: limit the number of levels of policy namespaces
https://notcve.org/view.php?id=CVE-2026-23405
01 Apr 2026 — In the Linux kernel, the following vulnerability has been resolved: apparmor: fix: limit the number of levels of policy namespaces Currently the number of policy namespaces is not bounded relying on the user namespace limit. However policy namespaces aren't strictly tied to user namespaces and it is possible to create them and nest them arbitrarily deep which can be used to exhaust system resource. Hard cap policy namespaces to the same depth as user namespaces. • https://git.kernel.org/stable/c/c88d4c7b049e87998ac0a9f455aa545cc895ef92 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2026-23404 – apparmor: replace recursive profile removal with iterative approach
https://notcve.org/view.php?id=CVE-2026-23404
01 Apr 2026 — In the Linux kernel, the following vulnerability has been resolved: apparmor: replace recursive profile removal with iterative approach The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes. Reproducer: $ pf='a'; for ((i=0; i<1024; i++)); do echo -e "profile $pf { \n }" | apparmor_parser -K -a; pf="$pf//x"; done $ echo -n a > /sys/kernel/security/apparmor/.remove Replace the recursive __aa_profile_list_release() approach with an i... • https://git.kernel.org/stable/c/c88d4c7b049e87998ac0a9f455aa545cc895ef92 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2026-23403 – apparmor: fix memory leak in verify_header
https://notcve.org/view.php?id=CVE-2026-23403
01 Apr 2026 — In the Linux kernel, the following vulnerability has been resolved: apparmor: fix memory leak in verify_header The function sets `*ns = NULL` on every call, leaking the namespace string allocated in previous iterations when multiple profiles are unpacked. This also breaks namespace consistency checking since *ns is always NULL when the comparison is made. Remove the incorrect assignment. The caller (aa_unpack) initializes *ns to NULL once before the loop, which is sufficient. • https://git.kernel.org/stable/c/dd51c84857630e77c139afe4d9bba65fc051dc3f •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2026-23398 – icmp: fix NULL pointer dereference in icmp_tag_validation()
https://notcve.org/view.php?id=CVE-2026-23398
26 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing a... • https://git.kernel.org/stable/c/8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2026-23397 – nfnetlink_osf: validate individual option lengths in fingerprints
https://notcve.org/view.php?id=CVE-2026-23397
26 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints nfnl_osf_add_callback() validates opt_num bounds and string NUL-termination but does not check individual option length fields. A zero-length option causes nf_osf_match_one() to enter the option matching loop even when foptsize sums to zero, which matches packets with no TCP options where ctx->optp is NULL: Oops: general protection fault KASAN: null-ptr-deref in range [0x0000... • https://git.kernel.org/stable/c/11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2026-23396 – wifi: mac80211: fix NULL deref in mesh_matches_local()
https://notcve.org/view.php?id=CVE-2026-23396
26 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL deref in mesh_matches_local() mesh_matches_local() unconditionally dereferences ie->mesh_config to compare mesh configuration parameters. When called from mesh_rx_csa_frame(), the parsed action-frame elements may not contain a Mesh Configuration IE, leaving ie->mesh_config NULL and triggering a kernel NULL pointer dereference. The other two callers are already safe: - ieee80211_mesh_rx_bcn_presp() checks !elems->mes... • https://git.kernel.org/stable/c/2e3c8736820bf72a8ad10721c7e31d36d4fa7790 •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2026-23392 – netfilter: nf_tables: release flowtable after rcu grace period on error
https://notcve.org/view.php?id=CVE-2026-23392
25 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtable can be already registered, exposing this flowtable to packet path and nfnetlink_hook control plane. This error path is rare, it should only happen by reaching the maximum number hooks or by failing to set up to hardware offload, just call synchronize_... • https://git.kernel.org/stable/c/3b49e2e94e6ebb8b23d0955d9e898254455734f8 •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2026-23391 – netfilter: xt_CT: drop pending enqueued packets on template removal
https://notcve.org/view.php?id=CVE-2026-23391
25 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_CT: drop pending enqueued packets on template removal Templates refer to objects that can go away while packets are sitting in nfqueue refer to: - helper, this can be an issue on module removal. - timeout policy, nfnetlink_cttimeout might remove it. The use of templates with zone and event cache filter are safe, since this just copies values. Flush these enqueued packets in case the template rule gets removed. • https://git.kernel.org/stable/c/24de58f465165298aaa8f286b2592f0163706cfe •