CVE-2026-23268

CVE-2026-23268 describes a confused-deputy vulnerability in the Linux kernel's AppArmor module that allows an unprivileged local user to load, replace, or remove AppArmor profiles. The flaw exists because the AppArmor policy management interface (apparmorfs) is writable by unprivileged processes, and a malicious user can pass a file descriptor to a privileged process, which then writes to the interface on their behalf, bypassing the usual privilege checks [1].

To exploit this, an attacker needs a privileged target process that can be manipulated into performing the write operation. Once exploited, the attacker gains full policy management capabilities, including removing existing profiles that protect critical services (e.g., cupsd, rsyslogd), loading restrictive profiles for denial of service, or bypassing Ubuntu's unprivileged user-namespace restrictions by loading a custom 'userns' profile [1]. The advisory notes that this can lead to denial of service, privilege escalation, and other severe outcomes.

The fix ensures that the task writing to the policy interface must have privileges that are a subset of the task that opened the interface, preventing unconfined processes from delegating access via file descriptors [1]. Patches have been applied to the Linux kernel stable trees as commits [2][3][4] to address this issue. Users should update their kernels to the latest stable releases to mitigate the vulnerability.