Junglewise Threat Intelligence

CVE-2026-23269: Linux Kernel AppArmor out-of-bounds read in policy unpacking

CVE-2026-23269 · Severity: high · CVSS 7.1 · Published 2026-03-18

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's AppArmor security module could allow a local attacker to cause a system crash or potentially access sensitive kernel memory. AppArmor is a security framework used to restrict the capabilities of programs. By providing a specially crafted security policy, an attacker can trigger an out-of-bounds memory read during the policy loading process.

Technical details

An out-of-bounds read vulnerability exists in the AppArmor 'unpack_pdb' function within 'security/apparmor/policy_unpack.c'. The issue stems from a failure to validate DFA (Deterministic Finite Automaton) start states, which are read from untrusted policy data and used as indexes into DFA state tables. Specifically, the 'aa_dfa_next()' function accesses 'dfa->tables[YYTD_ID_BASE][start]' without verifying if the 'start' index is within the bounds of the state table. A local attacker with the ability to load AppArmor policies can exploit this to trigger a kernel oops (DoS) or read sensitive kernel memory. Patches have been released for multiple stable kernel branches to reject policies with out-of-bounds start states during unpacking.

Affected products

  • Linux Linux Kernel 3.4 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.169, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.18, 6.19 to 6.19.8, 7.0-rc1 to 7.0-rc3

Timeline

  • 2026-03-10: disclosed: Reported by Qualys Security Advisory
  • 2026-03-18: advisory: Initial CVE publication
  • 2026-03-25: patched: Patch committed to stable kernel tree

References