CVE-2026-23269
published 2026-03-18CVE-2026-23269: In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from…
PriorityP432high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.13%
3.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
apparmor: validate DFA start states are in bounds in unpack_pdb
Start states are read from untrusted data and used as indexes into the
DFA state tables. The aa_dfa_next() function call in unpack_pdb() will
access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds
the number of states in the DFA, this results in an out-of-bound read.
BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360
Read of size 4 at addr ffff88811956fb90 by task su/1097
...
Reject policies with out-of-bounds start states during unpacking
to prevent the issue.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.164-1 (bookworm) | linux 6.1.164-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= ad5ff3db53c68c2f12936bc74ea5dfe0af943592 < f43eea8ae0102ea198da211ef7f5ce83725ecf19 | f43eea8ae0102ea198da211ef7f5ce83725ecf19 |
| linux | linux | >= ad5ff3db53c68c2f12936bc74ea5dfe0af943592 < 5487871b2b56c19d26936ed6fdc62652b30941df | 5487871b2b56c19d26936ed6fdc62652b30941df |
| linux | linux | >= ad5ff3db53c68c2f12936bc74ea5dfe0af943592 < 5443c027ec16afa55b1b8a3e7a1ab2ea3c77767a | 5443c027ec16afa55b1b8a3e7a1ab2ea3c77767a |
| linux | linux | >= ad5ff3db53c68c2f12936bc74ea5dfe0af943592 < 07cf6320f40ea2ccfad63728cff34ecb309d03da | 07cf6320f40ea2ccfad63728cff34ecb309d03da |
| linux | linux | >= ad5ff3db53c68c2f12936bc74ea5dfe0af943592 < 15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c | 15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c |
| linux | linux | >= ad5ff3db53c68c2f12936bc74ea5dfe0af943592 < 0baadb0eece2c4d939db10d3c323b4652ac79a58 | 0baadb0eece2c4d939db10d3c323b4652ac79a58 |
| linux | linux | >= ad5ff3db53c68c2f12936bc74ea5dfe0af943592 < 3bb7db43e32190c973d4019037cedb7895920184 | 3bb7db43e32190c973d4019037cedb7895920184 |
| linux | linux | >= ad5ff3db53c68c2f12936bc74ea5dfe0af943592 < 9063d7e2615f4a7ab321de6b520e23d370e58816 | 9063d7e2615f4a7ab321de6b520e23d370e58816 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.251-1 | 5.10.251-1 |
| linux | linux_kernel | >= 0 < 6.1.164-1 | 6.1.164-1 |
| linux | linux_kernel | >= 0 < 6.12.74-2 | 6.12.74-2 |
| linux | linux_kernel | >= 0 < 6.19.6-2 | 6.19.6-2 |
| linux | linux_kernel | >= 3.4 < 5.10.253 | 5.10.253 |
| linux | linux_kernel | >= 3.4.0 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 5.11 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.169 | 6.1.169 |
| linux | linux_kernel | >= 6.13 < 6.18.18 | 6.18.18 |
| linux | linux_kernel | >= 6.13.0 < 6.18.18 | 6.18.18 |
| linux | linux_kernel | >= 6.19 < 6.19.8 | 6.19.8 |
| linux | linux_kernel | >= 6.19.0 < 6.19.8 | 6.19.8 |
| linux | linux_kernel | >= 6.2 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 6.7 < 6.12.77 | 6.12.77 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian7.1HIGH
vendor_msrc7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.12.76/6.18.17/6.19.7/7.0-rc3 apparmor aa_dfa_next out-of-bounds (EUVD-2026-12912 / Nessus ID 303009)
vuldb·2026-06-01·CVSS 7.1
CVE-2026-23269 [HIGH] Linux Kernel up to 6.12.76/6.18.17/6.19.7/7.0-rc3 apparmor aa_dfa_next out-of-bounds (EUVD-2026-12912 / Nessus ID 303009)
A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.12.76/6.18.17/6.19.7/7.0-rc3. Impacted is the function aa_dfa_next of the component apparmor. The manipulation results in out-of-bounds read.
This vulnerability is identified as CVE-2026-23269. The attack can only be performed from the local network. There is not any exploit available.
It is advisable to upgrade the affected component.
OSV
linux-oem-6.17 vulnerabilities
osv·2026-04-06·CVSS 7.2
CVE-2025-62626 [HIGH] linux-oem-6.17 vulnerabilities
linux-oem-6.17 vulnerabilities
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026
OSV
linux-raspi vulnerabilities
osv·2026-04-01·CVSS 7.8
CVE-2026-23268 [HIGH] linux-raspi vulnerabilities
linux-raspi vulnerabilities
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Nios II architecture;
- PowerPC architecture;
- Sun Sparc architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM
OSV
apparmor: validate DFA start states are in bounds in unpack_pdb
osv·2026-03-18·CVSS 7.1
CVE-2026-23269 [HIGH] apparmor: validate DFA start states are in bounds in unpack_pdb
apparmor: validate DFA start states are in bounds in unpack_pdb
In the Linux kernel, the following vulnerability has been resolved:
apparmor: validate DFA start states are in bounds in unpack_pdb
Start states are read from untrusted data and used as indexes into the
DFA state tables. The aa_dfa_next() function call in unpack_pdb() will
access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds
the number of states in the DFA, this results in an out-of-bound read.
BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360
Read of size 4 at addr ffff88811956fb90 by task su/1097
...
Reject policies with out-of-bounds start states during unpacking
to prevent the issue.
OSV
CVE-2026-23269: In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are r
osv·2026-03-18·CVSS 7.1
CVE-2026-23269 [HIGH] CVE-2026-23269: In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are r
In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read. ================================================================== BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360 Read of size 4 at addr ffff88811956fb90 by task su/1097 ... Reject policies with out-of-bounds start states during unpacking to prevent the issue.
GHSA
GHSA-cq3w-r62m-5jvq: In the Linux kernel, the following vulnerability has been resolved:
apparmor: validate DFA start states are in bounds in unpack_pdb
Start states are
ghsa_unreviewed·2026-03-18
CVE-2026-23269 [HIGH] GHSA-cq3w-r62m-5jvq: In the Linux kernel, the following vulnerability has been resolved:
apparmor: validate DFA start states are in bounds in unpack_pdb
Start states are
In the Linux kernel, the following vulnerability has been resolved:
apparmor: validate DFA start states are in bounds in unpack_pdb
Start states are read from untrusted data and used as indexes into the
DFA state tables. The aa_dfa_next() function call in unpack_pdb() will
access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds
the number of states in the DFA, this results in an out-of-bound read.
BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360
Read of size 4 at addr ffff88811956fb90 by task su/1097
...
Reject policies with out-of-bounds start states during unpacking
to prevent the issue.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-05-11·CVSS 5.5
CVE-2026-23411 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Network drivers;
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-05-11·CVSS 5.5
CVE-2026-23411 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- Cryptogra
Ubuntu
Linux kernel (Xilinx) vulnerabilities
vendor_ubuntu·2026-05-07·CVSS 6.4
CVE-2025-68288 [MEDIUM] Linux kernel (Xilinx) vulnerabilities
Title: Linux kernel (Xilinx) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo
Rizzo discovered that some AMD Zen processors did not properly verify the
signature of CPU microcode. This flaw is known as EntrySign. A privileged
attacker could possibly use this issue to cause load malicious CPU
microcode causing loss of integrity and confidentiality. (CVE-2024-36347)
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation,
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-05-07·CVSS 7.8
CVE-2025-22058 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corre
Ubuntu
Linux kernel (BlueField) vulnerabilities
vendor_ubuntu·2026-04-29·CVSS 4.7
CVE-2022-48875 [MEDIUM] Linux kernel (BlueField) vulnerabilities
Title: Linux kernel (BlueField) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update c
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-04-22·CVSS 4.7
CVE-2026-23410 [MEDIUM] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corre
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-04-20·CVSS 4.7
CVE-2025-40215 [MEDIUM] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 architecture;
- GPIO subsystem;
- GPU drivers;
- BTRFS file system;
- XFRM subsystem;
- IPv4 networking;
- IPv6 networking;
Ubuntu
Kernel Live Patch Security Notice
vendor_ubuntu·2026-04-13·CVSS 7.8
CVE-2025-21704 [HIGH] Kernel Live Patch Security Notice
Title: Kernel Live Patch Security Notice
Summary: Several security issues were fixed in the kernel.
In the Linux kernel, the following vulnerability has been
resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At
btrfs_ref_tree_mod() after we successfully inserted the new ref entry
(local variable 'ref') into the respective block entry's rbtree (local
variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF,
we error out and free the ref entry without removing it from the block
entry's rbtree.
In the Linux kernel, the following vulnerability has been
resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in
brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in
brcmfmac that occurs when a high 'sd_sgentry_align' value
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-04-13·CVSS 7.8
CVE-2024-53114 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corre
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities
vendor_ubuntu·2026-04-09·CVSS 7.8
CVE-2025-21833 [HIGH] Linux kernel (Azure FIPS) vulnerabilities
Title: Linux kernel (Azure FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities
vendor_ubuntu·2026-04-09·CVSS 7.8
CVE-2025-71125 [HIGH] Linux kernel (Azure FIPS) vulnerabilities
Title: Linux kernel (Azure FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update
Ubuntu
Linux kernel (Intel IoTG Real-time) vulnerabilities
vendor_ubuntu·2026-04-09·CVSS 7.8
CVE-2026-23410 [HIGH] Linux kernel (Intel IoTG Real-time) vulnerabilities
Title: Linux kernel (Intel IoTG Real-time) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
Th
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-04-06·CVSS 7.2
CVE-2026-23404 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibl
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-04-01·CVSS 7.8
CVE-2025-38129 [HIGH] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Nios II architecture;
- PowerPC architecture;
- Sun Sparc architecture;
- User-Mode Linux (UML);
Red Hat
kernel: apparmor: validate DFA start states are in bounds in unpack_pdb
vendor_redhat·2026-03-18·CVSS 7.1
CVE-2026-23269 [HIGH] kernel: apparmor: validate DFA start states are in bounds in unpack_pdb
kernel: apparmor: validate DFA start states are in bounds in unpack_pdb
In the Linux kernel, the following vulnerability has been resolved:
apparmor: validate DFA start states are in bounds in unpack_pdb
Start states are read from untrusted data and used as indexes into the
DFA state tables. The aa_dfa_next() function call in unpack_pdb() will
access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds
the number of states in the DFA, this results in an out-of-bound read.
BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360
Read of size 4 at addr ffff88811956fb90 by task su/1097
...
Reject policies with out-of-bounds start states during unpacking
to prevent the issue.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux
Microsoft
apparmor: validate DFA start states are in bounds in unpack_pdb
vendor_msrc·2026-03-10·CVSS 7.1
CVE-2026-23269 [HIGH] apparmor: validate DFA start states are in bounds in unpack_pdb
apparmor: validate DFA start states are in bounds in unpack_pdb
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2026-23269: linux - In the Linux kernel, the following vulnerability has been resolved: apparmor: v...
vendor_debian·2026·CVSS 7.1
CVE-2026-23269 [HIGH] CVE-2026-23269: linux - In the Linux kernel, the following vulnerability has been resolved: apparmor: v...
In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read. ================================================================== BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360 Read of size 4 at addr ffff88811956fb90 by task su/1097 ... Reject policies with out-of-bounds start states during unpacking to prevent the issue.
Scope: local
bookworm: resolved (fixed in 6.1.164-1)
bullseye: resolved (fixed in 5.10.251-1)
forky: resolved (
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/07cf6320f40ea2ccfad63728cff34ecb309d03dahttps://git.kernel.org/stable/c/0baadb0eece2c4d939db10d3c323b4652ac79a58https://git.kernel.org/stable/c/15c3eb8916e7db01cb246d04a1fe6f0fdc065b0chttps://git.kernel.org/stable/c/3bb7db43e32190c973d4019037cedb7895920184https://git.kernel.org/stable/c/5443c027ec16afa55b1b8a3e7a1ab2ea3c77767ahttps://git.kernel.org/stable/c/5487871b2b56c19d26936ed6fdc62652b30941dfhttps://git.kernel.org/stable/c/9063d7e2615f4a7ab321de6b520e23d370e58816https://git.kernel.org/stable/c/f43eea8ae0102ea198da211ef7f5ce83725ecf19https://www.qualys.com/2026/03/10/crack-armor.txt
2026-03-18
Published