Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-23411 is a high-severity Race Condition (CWE-362) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-39 (Process Isolation) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-23411 is a race condition vulnerability in the Linux kernel's AppArmor module. The issue arises when AppArmor releases a reference to i_private data after removing the corresponding entry from the file system, while the inode may persist longer. This allows filesystem callback functions to access the data after it has been freed, creating a race between data freeing and filesystem access. Rawdata/loaddata structures are the most likely to trigger the failure due to fewer references, though crafted scenarios might affect other i_private data types.
A local attacker with low privileges can exploit this vulnerability, as indicated by its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation requires low attack complexity and no user interaction, potentially leading to high impacts on confidentiality, integrity, and availability through use-after-free access to kernel memory.
Mitigation involves applying kernel patches from the provided stable commit references, which relocate the reference put operation to inode eviction, ensuring data is not accessed after freeing. The top references include kernel.org stable commits such as 13bc2772414d68e94e273dea013181a986948ddf, 2a732ed26fbd048e7925d227af8cf9ea43fb5cc9, 3ddb961d2929bbb3204a2bba21b5d8153cd3f7cc, 667df93769c02ff581c77d2d8f162147e719c557, and 8e135b8aee5a06c52a4347a5a6d51223c6f36ba3.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17843
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system.…
more
However the inode can aand does live beyond that point and it is possible that some of the fs call back functions will be invoked after the reference has been put, which results in a race between freeing the data and accessing it through the fs. While the rawdata/loaddata is the most likely candidate to fail the race, as it has the fewest references. If properly crafted it might be possible to trigger a race for the other types stored in i_private. Fix this by moving the put of i_private referenced data to the correct place which is during inode eviction.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Maintaining separate execution domains for each process structurally eliminates unintended concurrent access to the same shared resources.
Preventing unintended information transfer through shared system resources directly addresses the improper concurrent modification that defines a race condition.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect race conditions, but does not prevent them at design or coding time.
Secure coding standards explicitly forbid unsafe concurrent access patterns and mandate atomic operations or locks.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-362, a class-level weakness, and none of its children carries one either.