CVE-2026-23403
Memory Leak in Linux Kernel AppArmor verify_header Function
Publication date: 2026-04-01
Last updated on: 2026-04-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 3.12 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.2 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.77 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 3.12.1 (inc) to 5.10.253 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.169 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.18 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory leak in the Linux kernel's AppArmor component, specifically in the verify_header function.
The function incorrectly sets the pointer *ns to NULL on every call, which causes the namespace string allocated in previous iterations to be leaked when multiple profiles are unpacked.
Additionally, this incorrect assignment breaks namespace consistency checking because *ns is always NULL during the comparison.
The fix involves removing the incorrect assignment, relying instead on the caller (aa_unpack) to initialize *ns to NULL once before the loop, which is sufficient.
How can this vulnerability impact me? :
This vulnerability can lead to a memory leak in the Linux kernel when multiple AppArmor profiles are unpacked.
Memory leaks can degrade system performance over time by consuming more memory than necessary.
Furthermore, the broken namespace consistency checking could potentially cause incorrect security profile behavior, which might affect the enforcement of security policies.