Technical Summary

CVE-2026-23410 describes a race condition in the Linux kernel's AppArmor LSM where rawdata inodes are not properly reference counted, leading to a use-after-free vulnerability. An attacker can exploit this by concurrently opening a rawdata file and removing its last reference (e.g., by deleting the associated profile), which frees the underlying struct aa_loaddata. Subsequent access to i_private results in dereferencing freed memory. The vulnerability is fixed by moving to a double reference counting scheme that breaks the circular dependency and ensures rawdata is freed only after all inode references are released. This flaw affects numerous specific versions of the linux-azure kernel. The CVSS v3.1 score is 7.8 (high), indicating local attack vector with low complexity, requiring low privileges, no user interaction, and impacts confidentiality, integrity, and availability. The vendor advisory from Ubuntu confirms the availability of patches and recommends updating to fixed kernel versions.