CVE-2026-23268
published 2026-03-18CVE-2026-23268: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged…
PriorityP344high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
3.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix unprivileged local user can do privileged policy management
An unprivileged local user can load, replace, and remove profiles by
opening the apparmorfs interfaces, via a confused deputy attack, by
passing the opened fd to a privileged process, and getting the
privileged process to write to the interface.
This does require a privileged target that can be manipulated to do
the write for the unprivileged process, but once such access is
achieved full policy management is possible and all the possible
implications that implies: removing confinement, DoS of system or
target applications by denying all execution, by-passing the
unprivileged user namespace restriction, to exploiting kernel bugs for
a local privilege escalation.
The policy management interface can not have its permissions simply
changed from 0666 to 0600 because non-root processes need to be able
to load policy to different policy namespaces.
Instead ensure the task writing the interface has privileges that
are a subset of the task that opened the interface. This is already
done via policy for confined processes, but unconfined can delegate
access to the opened fd, by-passing the usual policy check.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.164-1 (bookworm) | linux 6.1.164-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= b7fd2c0340eacbee892425e9007647568b7f2a3c < a407a078cd41b5261b99d822af784bd9f136eb4d | a407a078cd41b5261b99d822af784bd9f136eb4d |
| linux | linux | >= b7fd2c0340eacbee892425e9007647568b7f2a3c < 4cafce4d6d0a66ec27e3af5637c11901d60189fa | 4cafce4d6d0a66ec27e3af5637c11901d60189fa |
| linux | linux | >= b7fd2c0340eacbee892425e9007647568b7f2a3c < 33ee909702e047c94aaf41d4eea35626d509802c | 33ee909702e047c94aaf41d4eea35626d509802c |
| linux | linux | >= b7fd2c0340eacbee892425e9007647568b7f2a3c < 17debf5586020790b5717f96e5e6a3ca5bb961ab | 17debf5586020790b5717f96e5e6a3ca5bb961ab |
| linux | linux | >= b7fd2c0340eacbee892425e9007647568b7f2a3c < 0fc63dd9170643d15c25681fca792539e23f4640 | 0fc63dd9170643d15c25681fca792539e23f4640 |
| linux | linux | >= b7fd2c0340eacbee892425e9007647568b7f2a3c < b60b3f7a35c46b2e0ca934f9c988b8fca06d76c6 | b60b3f7a35c46b2e0ca934f9c988b8fca06d76c6 |
| linux | linux | >= b7fd2c0340eacbee892425e9007647568b7f2a3c < b6a94eeca9c6c8f7c55ad44c62c98324f51ec596 | b6a94eeca9c6c8f7c55ad44c62c98324f51ec596 |
| linux | linux | >= b7fd2c0340eacbee892425e9007647568b7f2a3c < 6601e13e82841879406bf9f369032656f441a425 | 6601e13e82841879406bf9f369032656f441a425 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.251-1 | 5.10.251-1 |
| linux | linux_kernel | >= 0 < 6.1.164-1 | 6.1.164-1 |
| linux | linux_kernel | >= 0 < 6.12.74-2 | 6.12.74-2 |
| linux | linux_kernel | >= 0 < 6.19.6-2 | 6.19.6-2 |
| linux | linux_kernel | >= 4.11 < 5.10.253 | 5.10.253 |
| linux | linux_kernel | >= 4.11.0 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 5.11 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.169 | 6.1.169 |
| linux | linux_kernel | >= 6.13 < 6.18.18 | 6.18.18 |
| linux | linux_kernel | >= 6.13.0 < 6.18.18 | 6.18.18 |
| linux | linux_kernel | >= 6.19 < 6.19.8 | 6.19.8 |
| linux | linux_kernel | >= 6.19.0 < 6.19.8 | 6.19.8 |
| linux | linux_kernel | >= 6.2 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 6.7 < 6.12.77 | 6.12.77 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-05-11·CVSS 5.5
CVE-2026-23411 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Network drivers;
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-05-11·CVSS 5.5
CVE-2026-23411 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- Cryptogra
Ubuntu
Linux kernel (Xilinx) vulnerabilities
vendor_ubuntu·2026-05-07·CVSS 6.4
CVE-2025-68288 [MEDIUM] Linux kernel (Xilinx) vulnerabilities
Title: Linux kernel (Xilinx) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo
Rizzo discovered that some AMD Zen processors did not properly verify the
signature of CPU microcode. This flaw is known as EntrySign. A privileged
attacker could possibly use this issue to cause load malicious CPU
microcode causing loss of integrity and confidentiality. (CVE-2024-36347)
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation,
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-05-07·CVSS 7.8
CVE-2025-22058 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corre
Ubuntu
Linux kernel (BlueField) vulnerabilities
vendor_ubuntu·2026-04-29·CVSS 4.7
CVE-2022-48875 [MEDIUM] Linux kernel (BlueField) vulnerabilities
Title: Linux kernel (BlueField) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update c
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-04-22·CVSS 4.7
CVE-2026-23410 [MEDIUM] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corre
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-04-20·CVSS 4.7
CVE-2025-40215 [MEDIUM] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 architecture;
- GPIO subsystem;
- GPU drivers;
- BTRFS file system;
- XFRM subsystem;
- IPv4 networking;
- IPv6 networking;
Ubuntu
Kernel Live Patch Security Notice
vendor_ubuntu·2026-04-13·CVSS 7.8
CVE-2025-21704 [HIGH] Kernel Live Patch Security Notice
Title: Kernel Live Patch Security Notice
Summary: Several security issues were fixed in the kernel.
In the Linux kernel, the following vulnerability has been
resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At
btrfs_ref_tree_mod() after we successfully inserted the new ref entry
(local variable 'ref') into the respective block entry's rbtree (local
variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF,
we error out and free the ref entry without removing it from the block
entry's rbtree.
In the Linux kernel, the following vulnerability has been
resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in
brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in
brcmfmac that occurs when a high 'sd_sgentry_align' value
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-04-13·CVSS 7.8
CVE-2024-53114 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corre
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities
vendor_ubuntu·2026-04-09·CVSS 7.8
CVE-2025-21833 [HIGH] Linux kernel (Azure FIPS) vulnerabilities
Title: Linux kernel (Azure FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities
vendor_ubuntu·2026-04-09·CVSS 7.8
CVE-2025-71125 [HIGH] Linux kernel (Azure FIPS) vulnerabilities
Title: Linux kernel (Azure FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update
Ubuntu
Linux kernel (Intel IoTG Real-time) vulnerabilities
vendor_ubuntu·2026-04-09·CVSS 7.8
CVE-2026-23410 [HIGH] Linux kernel (Intel IoTG Real-time) vulnerabilities
Title: Linux kernel (Intel IoTG Real-time) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
Th
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-04-06·CVSS 7.2
CVE-2026-23404 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibl
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-04-01·CVSS 7.8
CVE-2025-38129 [HIGH] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Nios II architecture;
- PowerPC architecture;
- Sun Sparc architecture;
- User-Mode Linux (UML);
Red Hat
kernel: apparmor: fix unprivileged local user can do privileged policy management
vendor_redhat·2026-03-18·CVSS 7.8
CVE-2026-23268 [HIGH] kernel: apparmor: fix unprivileged local user can do privileged policy management
kernel: apparmor: fix unprivileged local user can do privileged policy management
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix unprivileged local user can do privileged policy management
An unprivileged local user can load, replace, and remove profiles by
opening the apparmorfs interfaces, via a confused deputy attack, by
passing the opened fd to a privileged process, and getting the
privileged process to write to the interface.
This does require a privileged target that can be manipulated to do
the write for the unprivileged process, but once such access is
achieved full policy management is possible and all the possible
implications that implies: removing confinement, DoS of system or
target applications by denying all execution, by-passing the
unpri
Microsoft
apparmor: fix unprivileged local user can do privileged policy management
vendor_msrc·2026-03-10·CVSS 7.8
CVE-2026-23268 [HIGH] apparmor: fix unprivileged local user can do privileged policy management
apparmor: fix unprivileged local user can do privileged policy management
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2026-23268: linux - In the Linux kernel, the following vulnerability has been resolved: apparmor: f...
vendor_debian·2026·CVSS 7.8
CVE-2026-23268 [HIGH] CVE-2026-23268: linux - In the Linux kernel, the following vulnerability has been resolved: apparmor: f...
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by passing the opened fd to a privileged process, and getting the privileged process to write to the interface. This does require a privileged target that can be manipulated to do the write for the unprivileged process, but once such access is achieved full policy management is possible and all the possible implications that implies: removing confinement, DoS of system or target applications by denying all execution, by-passing the unprivileged user namespace restriction, to exploiting kernel bugs for a local privilege
VulDB
Linux Kernel up to 6.12.76/6.18.17/6.19.7/7.0-rc3 Apparmorfs Interface permission (EUVD-2026-12910 / Nessus ID 303000)
vuldb·2026-06-01·CVSS 7.8
CVE-2026-23268 [HIGH] Linux Kernel up to 6.12.76/6.18.17/6.19.7/7.0-rc3 Apparmorfs Interface permission (EUVD-2026-12910 / Nessus ID 303000)
A vulnerability described as critical has been identified in Linux Kernel up to 6.12.76/6.18.17/6.19.7/7.0-rc3. This impacts an unknown function of the component Apparmorfs Interface. Executing a manipulation can lead to permission issues.
This vulnerability is registered as CVE-2026-23268. The attack needs to be launched locally. No exploit is available.
Upgrading the affected component is recommended.
OSV
linux-oem-6.17 vulnerabilities
osv·2026-04-06·CVSS 7.2
CVE-2025-62626 [HIGH] linux-oem-6.17 vulnerabilities
linux-oem-6.17 vulnerabilities
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026
OSV
linux-raspi vulnerabilities
osv·2026-04-01·CVSS 7.8
CVE-2026-23268 [HIGH] linux-raspi vulnerabilities
linux-raspi vulnerabilities
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Nios II architecture;
- PowerPC architecture;
- Sun Sparc architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM
OSV
apparmor: fix unprivileged local user can do privileged policy management
osv·2026-03-18·CVSS 7.8
CVE-2026-23268 [HIGH] apparmor: fix unprivileged local user can do privileged policy management
apparmor: fix unprivileged local user can do privileged policy management
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix unprivileged local user can do privileged policy management
An unprivileged local user can load, replace, and remove profiles by
opening the apparmorfs interfaces, via a confused deputy attack, by
passing the opened fd to a privileged process, and getting the
privileged process to write to the interface.
This does require a privileged target that can be manipulated to do
the write for the unprivileged process, but once such access is
achieved full policy management is possible and all the possible
implications that implies: removing confinement, DoS of system or
target applications by denying all execution, by-passing the
unprivileg
GHSA
GHSA-8qv8-8mpp-cc7j: In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix unprivileged local user can do privileged policy management
An unp
ghsa_unreviewed·2026-03-18
CVE-2026-23268 [HIGH] GHSA-8qv8-8mpp-cc7j: In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix unprivileged local user can do privileged policy management
An unp
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix unprivileged local user can do privileged policy management
An unprivileged local user can load, replace, and remove profiles by
opening the apparmorfs interfaces, via a confused deputy attack, by
passing the opened fd to a privileged process, and getting the
privileged process to write to the interface.
This does require a privileged target that can be manipulated to do
the write for the unprivileged process, but once such access is
achieved full policy management is possible and all the possible
implications that implies: removing confinement, DoS of system or
target applications by denying all execution, by-passing the
unprivileged user namespace restriction, to exploiting kernel bugs for
a local privil
OSV
CVE-2026-23268: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unpri
osv·2026-03-18·CVSS 7.8
CVE-2026-23268 [HIGH] CVE-2026-23268: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unpri
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by passing the opened fd to a privileged process, and getting the privileged process to write to the interface. This does require a privileged target that can be manipulated to do the write for the unprivileged process, but once such access is achieved full policy management is possible and all the possible implications that implies: removing confinement, DoS of system or target applications by denying all execution, by-passing the unprivileged user namespace restriction, to exploiting kernel bugs for a local privilege
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0fc63dd9170643d15c25681fca792539e23f4640https://git.kernel.org/stable/c/17debf5586020790b5717f96e5e6a3ca5bb961abhttps://git.kernel.org/stable/c/33ee909702e047c94aaf41d4eea35626d509802chttps://git.kernel.org/stable/c/4cafce4d6d0a66ec27e3af5637c11901d60189fahttps://git.kernel.org/stable/c/6601e13e82841879406bf9f369032656f441a425https://git.kernel.org/stable/c/a407a078cd41b5261b99d822af784bd9f136eb4dhttps://git.kernel.org/stable/c/b60b3f7a35c46b2e0ca934f9c988b8fca06d76c6https://git.kernel.org/stable/c/b6a94eeca9c6c8f7c55ad44c62c98324f51ec596https://www.qualys.com/2026/03/10/crack-armor.txt
2026-03-18
Published