CVE-2026-23269

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23269
In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read. ================================================================== BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360 Read of size 4 at addr ffff88811956fb90 by task su/1097 ... Reject policies with out-of-bounds start states during unpacking to prevent the issue.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/07cf6320f40ea2ccfad63728cff34ecb309d03da Patch
https://git.kernel.org/stable/c/0baadb0eece2c4d939db10d3c323b4652ac79a58 Patch
https://git.kernel.org/stable/c/15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c Patch
https://git.kernel.org/stable/c/3bb7db43e32190c973d4019037cedb7895920184 Patch
https://git.kernel.org/stable/c/5443c027ec16afa55b1b8a3e7a1ab2ea3c77767a Patch
https://git.kernel.org/stable/c/5487871b2b56c19d26936ed6fdc62652b30941df Patch
https://git.kernel.org/stable/c/9063d7e2615f4a7ab321de6b520e23d370e58816 Patch
https://git.kernel.org/stable/c/f43eea8ae0102ea198da211ef7f5ce83725ecf19 Patch
https://www.qualys.com/2026/03/10/crack-armor.txt Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
History

29 May 2026, 18:23

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
CWE CWE-125
References () https://git.kernel.org/stable/c/07cf6320f40ea2ccfad63728cff34ecb309d03da - () https://git.kernel.org/stable/c/07cf6320f40ea2ccfad63728cff34ecb309d03da - Patch
References () https://git.kernel.org/stable/c/0baadb0eece2c4d939db10d3c323b4652ac79a58 - () https://git.kernel.org/stable/c/0baadb0eece2c4d939db10d3c323b4652ac79a58 - Patch
References () https://git.kernel.org/stable/c/15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c - () https://git.kernel.org/stable/c/15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c - Patch
References () https://git.kernel.org/stable/c/3bb7db43e32190c973d4019037cedb7895920184 - () https://git.kernel.org/stable/c/3bb7db43e32190c973d4019037cedb7895920184 - Patch
References () https://git.kernel.org/stable/c/5443c027ec16afa55b1b8a3e7a1ab2ea3c77767a - () https://git.kernel.org/stable/c/5443c027ec16afa55b1b8a3e7a1ab2ea3c77767a - Patch
References () https://git.kernel.org/stable/c/5487871b2b56c19d26936ed6fdc62652b30941df - () https://git.kernel.org/stable/c/5487871b2b56c19d26936ed6fdc62652b30941df - Patch
References () https://git.kernel.org/stable/c/9063d7e2615f4a7ab321de6b520e23d370e58816 - () https://git.kernel.org/stable/c/9063d7e2615f4a7ab321de6b520e23d370e58816 - Patch
References () https://git.kernel.org/stable/c/f43eea8ae0102ea198da211ef7f5ce83725ecf19 - () https://git.kernel.org/stable/c/f43eea8ae0102ea198da211ef7f5ce83725ecf19 - Patch
References () https://www.qualys.com/2026/03/10/crack-armor.txt - () https://www.qualys.com/2026/03/10/crack-armor.txt - Third Party Advisory

18 Apr 2026, 09:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/5443c027ec16afa55b1b8a3e7a1ab2ea3c77767a -
  • () https://git.kernel.org/stable/c/5487871b2b56c19d26936ed6fdc62652b30941df -
  • () https://git.kernel.org/stable/c/f43eea8ae0102ea198da211ef7f5ce83725ecf19 -

02 Apr 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1

25 Mar 2026, 11:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/07cf6320f40ea2ccfad63728cff34ecb309d03da -
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: apparmor: validar que los estados iniciales de DFA están dentro de los límites en unpack_pdb Los estados iniciales se leen de datos no confiables y se usan como índices en las tablas de estados de DFA. La llamada a la función aa_dfa_next() en unpack_pdb() accederá a dfa->tables[YYTD_ID_BASE][start], y si el estado inicial excede el número de estados en el DFA, esto resulta en una lectura fuera de límites. ================================================================== ERROR: KASAN: slab-out-of-bounds en aa_dfa_next+0x2a1/0x360 Lectura de tamaño 4 en la dirección ffff88811956fb90 por la tarea su/1097 ... Rechazar políticas con estados iniciales fuera de límites durante el desempaquetado para prevenir el problema.

23 Mar 2026, 14:16

Type Values Removed Values Added
References
  • () https://www.qualys.com/2026/03/10/crack-armor.txt -

18 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-18 18:16

Updated : 2026-05-29 18:23

NVD link : CVE-2026-23269

Mitre link : CVE-2026-23269

CVE.ORG link : CVE-2026-23269

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read