Junglewise Threat Intelligence

CVE-2026-23268: Linux Kernel AppArmor privilege escalation in policy management interface

CVE-2026-23268 · Severity: high · CVSS 7.8 · Published 2026-03-18

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's AppArmor security module allows a standard user to perform administrative security tasks. By tricking a privileged system process into writing to a specific interface, an attacker can remove security restrictions, cause system crashes, or gain full administrative control. This bypasses the intended security boundaries that normally isolate applications and users from each other.

Technical details

A confused deputy vulnerability exists in the AppArmor policy management interface (apparmorfs). An unprivileged local user can open file descriptors for policy interfaces (load, replace, remove) and pass them to a privileged process. If the privileged process can be manipulated into writing to these descriptors, the kernel fails to verify that the writing task possesses the necessary privileges relative to the task that originally opened the interface. This allows for the unauthorized modification of AppArmor profiles, bypassing user namespace restrictions and enabling local privilege escalation. The fix introduces a check to ensure the task writing to the interface has privileges that are a subset of the task that opened the interface.

Affected products

  • Linux Linux Kernel 4.11 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.169, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.18, 6.19 to 6.19.8, 7.0-rc1 to 7.0-rc3

Timeline

  • 2025-11-07: other: Initial patch authored
  • 2026-03-10: advisory: Qualys Third Party Advisory published
  • 2026-03-13: patched: Patch committed to stable tree
  • 2026-03-18: disclosed: CVE published

References