{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-23409",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-01-13T15:37:46.013Z",
        "datePublished": "2026-04-01T08:36:38.516Z",
        "dateUpdated": "2026-05-11T22:06:21.118Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-05-11T22:06:21.118Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix differential encoding verification\n\nDifferential encoding allows loops to be created if it is abused. To\nprevent this the unpack should verify that a diff-encode chain\nterminates.\n\nUnfortunately the differential encode verification had two bugs.\n\n1. it conflated states that had gone through check and already been\n   marked, with states that were currently being checked and marked.\n   This means that loops in the current chain being verified are treated\n   as a chain that has already been verified.\n\n2. the order bailout on already checked states compared current chain\n   check iterators j,k instead of using the outer loop iterator i.\n   Meaning a step backwards in states in the current chain verification\n   was being mistaken for moving to an already verified state.\n\nMove to a double mark scheme where already verified states get a\ndifferent mark, than the current chain being kept. This enables us\nto also drop the backwards verification check that was the cause of\nthe second error as any already verified state is already marked."
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "security/apparmor/include/match.h",
                        "security/apparmor/match.c"
                    ],
                    "versions": [
                        {
                            "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
                            "lessThan": "ff7c73744fafe944ed9a7b2b7cf6c8d5557a3d84",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
                            "lessThan": "1439150cd3c411228b387ab5efca92199d2a659a",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
                            "lessThan": "0fab44285445e9012674396d5c1236a67da518e0",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
                            "lessThan": "f90e3ecd9e1ed69f1a370f866ceed1f104f3ab4a",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
                            "lessThan": "34fc60b125ed1d4eb002c76b0664bf0619492167",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
                            "lessThan": "623a9d211bbbb031bb1cbdb38b23487648167f8a",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
                            "lessThan": "1ff4857fac56ac5a90ee63b24db05fa5e91a45aa",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
                            "lessThan": "39440b137546a3aa383cfdabc605fb73811b6093",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "security/apparmor/include/match.h",
                        "security/apparmor/match.c"
                    ],
                    "versions": [
                        {
                            "version": "4.17",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "4.17",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.10.253",
                            "lessThanOrEqual": "5.10.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.15.203",
                            "lessThanOrEqual": "5.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.169",
                            "lessThanOrEqual": "6.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.130",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.77",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.18",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.19.8",
                            "lessThanOrEqual": "6.19.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.0",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "5.10.253"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "5.15.203"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "6.1.169"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "6.6.130"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "6.12.77"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "6.18.18"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "6.19.8"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "7.0"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/ff7c73744fafe944ed9a7b2b7cf6c8d5557a3d84"
                },
                {
                    "url": "https://git.kernel.org/stable/c/1439150cd3c411228b387ab5efca92199d2a659a"
                },
                {
                    "url": "https://git.kernel.org/stable/c/0fab44285445e9012674396d5c1236a67da518e0"
                },
                {
                    "url": "https://git.kernel.org/stable/c/f90e3ecd9e1ed69f1a370f866ceed1f104f3ab4a"
                },
                {
                    "url": "https://git.kernel.org/stable/c/34fc60b125ed1d4eb002c76b0664bf0619492167"
                },
                {
                    "url": "https://git.kernel.org/stable/c/623a9d211bbbb031bb1cbdb38b23487648167f8a"
                },
                {
                    "url": "https://git.kernel.org/stable/c/1ff4857fac56ac5a90ee63b24db05fa5e91a45aa"
                },
                {
                    "url": "https://git.kernel.org/stable/c/39440b137546a3aa383cfdabc605fb73811b6093"
                }
            ],
            "title": "apparmor: fix differential encoding verification",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}