CVE-2026-23405
Last modified
CVE-2026-23405 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: apparmor: fix: limit the number of levels of policy namespaces Currently the number of policy namespaces is not bounded relying on the user namespace limit. However policy namespaces aren't strictly tied to user namespaces and it is possible to create them and nest them arbitrarily deep which can be used to exhaust system resource. Hard cap policy namespaces to the same depth as user namespaces.. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix: limit the number of levels of policy namespaces Currently the number of policy namespaces is not bounded relying on the user namespace limit. However policy namespaces aren't strictly tied to user namespaces and it is possible to create them and nest them arbitrarily deep which can be used to exhaust system resource. Hard cap policy namespaces to the same depth as user namespaces.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Linux | Linux Kernel | >= 2.6.36.1, < 5.10.253 | — |
| Linux | Linux Kernel | >= 5.11, < 5.15.203 | — |
| Linux | Linux Kernel | >= 5.16, < 6.1.169 | — |
| Linux | Linux Kernel | >= 6.2, < 6.6.130 | — |
| Linux | Linux Kernel | >= 6.7, < 6.12.77 | — |
| Linux | Linux Kernel | >= 6.13, < 6.18.18 | — |
| Linux | Linux Kernel | >= 6.19, < 6.19.8 | — |
| Linux | Linux Kernel | 2.6.36 | — |
| Linux | Linux Kernel | 7.0 | Rc1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-23405?
How severe is CVE-2026-23405?
How do I fix CVE-2026-23405?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-2340A flaw was found in Samba’s vfs_worm module. The module is i…6.5
- CVE-2026-23400In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2026-23401In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2026-23402In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2026-23403In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2026-23404In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2026-23406In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-23407In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-23408In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-23409In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2026-23410In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-23411In the Linux kernel, the following vulnerability has been re…7.8
Are you affected by CVE-2026-23405?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST