Executive brief
A vulnerability was identified in the Linux kernel's AppArmor security module, which is responsible for restricting programs' capabilities to enhance system security. The issue involves how the system handles memory when creating internal security tables from data provided by users. If exploited, this could lead to system instability or potential security bypasses by causing the kernel to perform improper memory operations.
Technical details
A vulnerability in the AppArmor module of the Linux kernel stemmed from improper handling of potentially unaligned memory blobs provided by userspace during DFA (Deterministic Finite Automaton) table creation. Specifically, the `UNPACK_ARRAY` macro and `unpack_table` function in `security/apparmor/match.c` did not account for unaligned memory accesses when converting big-endian data to CPU-native format. This could lead to kernel oops or undefined behavior on architectures that do not support unaligned accesses. The fix introduces the use of `get_unaligned_be16` and `get_unaligned_be32` to safely handle these accesses and optimizes the process using `memcpy` where appropriate. Patching is available via the stable kernel updates.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026
Timeline
- 2025-11-26: other: Initial patch authored
- 2026-05-27: advisory: CVE-2026-45893 published