CVE-2026-23409
Improper Loop Verification in Linux AppArmor Differential Encoding
Publication date: 2026-04-01
Last updated on: 2026-04-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 4.17 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.2 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.77 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.169 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.18 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.8 (exc) |
| linux | linux_kernel | From 4.17.1 (inc) to 5.10.253 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's AppArmor component related to differential encoding verification.
Differential encoding is a process that can create loops if abused, so the verification process must ensure that these loops terminate properly.
The vulnerability arises because the verification had two bugs: first, it confused states that were already checked with states currently being checked, causing loops in the current chain to be mistakenly treated as already verified.
Second, the verification incorrectly used inner loop iterators instead of the outer loop iterator, causing backward steps in the current chain to be mistaken for already verified states.
The fix involved implementing a double mark scheme to differentiate between already verified states and states currently being checked, eliminating the errors caused by the previous verification logic.
How can this vulnerability impact me? :
This vulnerability in the Linux kernel's AppArmor component involves bugs in the differential encoding verification process. Specifically, it allows loops to be created if differential encoding is abused due to improper verification of the diff-encode chain termination.
The impact is that the verification process may incorrectly treat loops in the current chain as already verified states, potentially leading to security issues related to improper enforcement of AppArmor policies.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in the Linux kernel related to AppArmor's differential encoding verification has been fixed by implementing a double mark scheme to correctly verify differential encoding chains and prevent loops.
To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.