CVE-2026-23409
Received Received - Intake
Improper Loop Verification in Linux AppArmor Differential Encoding

Publication date: 2026-04-01

Last updated on: 2026-04-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix differential encoding verification Differential encoding allows loops to be created if it is abused. To prevent this the unpack should verify that a diff-encode chain terminates. Unfortunately the differential encode verification had two bugs. 1. it conflated states that had gone through check and already been marked, with states that were currently being checked and marked. This means that loops in the current chain being verified are treated as a chain that has already been verified. 2. the order bailout on already checked states compared current chain check iterators j,k instead of using the outer loop iterator i. Meaning a step backwards in states in the current chain verification was being mistaken for moving to an already verified state. Move to a double mark scheme where already verified states get a different mark, than the current chain being kept. This enables us to also drop the backwards verification check that was the cause of the second error as any already verified state is already marked.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-01
Last Modified
2026-04-24
Generated
2026-05-07
AI Q&A
2026-04-01
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 15 associated CPEs
Vendor Product Version / Range
linux linux_kernel 4.17
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.2 (inc) to 6.6.130 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.77 (exc)
linux linux_kernel From 5.11 (inc) to 5.15.203 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.169 (exc)
linux linux_kernel From 6.13 (inc) to 6.18.18 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.8 (exc)
linux linux_kernel From 4.17.1 (inc) to 5.10.253 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's AppArmor component related to differential encoding verification.

Differential encoding is a process that can create loops if abused, so the verification process must ensure that these loops terminate properly.

The vulnerability arises because the verification had two bugs: first, it confused states that were already checked with states currently being checked, causing loops in the current chain to be mistakenly treated as already verified.

Second, the verification incorrectly used inner loop iterators instead of the outer loop iterator, causing backward steps in the current chain to be mistaken for already verified states.

The fix involved implementing a double mark scheme to differentiate between already verified states and states currently being checked, eliminating the errors caused by the previous verification logic.


How can this vulnerability impact me? :

This vulnerability in the Linux kernel's AppArmor component involves bugs in the differential encoding verification process. Specifically, it allows loops to be created if differential encoding is abused due to improper verification of the diff-encode chain termination.

The impact is that the verification process may incorrectly treat loops in the current chain as already verified states, potentially leading to security issues related to improper enforcement of AppArmor policies.


What immediate steps should I take to mitigate this vulnerability?

The vulnerability in the Linux kernel related to AppArmor's differential encoding verification has been fixed by implementing a double mark scheme to correctly verify differential encoding chains and prevent loops.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart