CVE-2026-23403

Vulnerability

In the Linux kernel's AppArmor security module, the function verify_header() contains a memory leak triggered during the unpacking of multiple profiles. The function unconditionally sets *ns = NULL at the start of each call, discarding any previously allocated namespace string without freeing it. Because the caller aa_unpack() loops over profiles while reusing the same ns pointer, each iteration leaks the memory allocated for the previous profile's namespace, and also prevents namespace consistency checks from functioning correctly — since *ns is always NULL when compared.

Exploitation

The bug is triggered by normal kernel operations that load AppArmor profiles from user space, such as policy updates or system startup. No special privileges beyond those required to load profiles (typically root or a process with CAP_MAC_ADMIN) are needed to trigger the leak. An attacker who can repeatedly cause profile reloads could exhaust kernel memory, leading to a denial-of-service condition. The leak also undermines namespace verification, but the security impact depends on the kernel's configuration and the specific policy being loaded.

Impact

An attacker able to repeatedly trigger AppArmor profile loads can cause a kernel memory leak, eventually exhausting system memory and resulting in a denial of service. The broken namespace consistency check could also allow loading profiles from unintended namespaces, potentially bypassing security boundaries.

Mitigation

The fix [1] simply removes the incorrect *ns = NULL assignment in verify_header(), relying on the caller aa_unpack() which already initializes *ns to NULL once before the loop [1]. The patch has been merged into the Linux kernel stable trees as commits [1][2][3][4]. Users should update their kernels to the latest stable releases containing these commits.