CVE-2026-23269

Vulnerability

CVE-2026-23269 is an out-of-bounds read vulnerability in the Linux kernel's AppArmor security module. The flaw resides in the unpack_pdb() function, which reads DFA (Deterministic Finite Automaton) start states from untrusted policy data. These start states are used as indexes into the DFA state tables without proper bounds checking. When aa_dfa_next() accesses dfa->tables[YYTD_ID_BASE][start], a start state exceeding the number of states in the DFA triggers a slab-out-of-bounds read, as demonstrated by a KASAN report [1].\.

Exploitation

An attacker who can supply a crafted AppArmor policy (for example, by exploiting the confused-deputy problem described in the Qualys advisory [1]) can trigger this bug during policy unpacking. The attack requires the ability to load a malicious policy into the kernel, which may be achieved by an unprivileged local attacker in certain configurations [1].

Impact

Successful exploitation results in an out-of-bounds read, which can leak sensitive kernel memory or cause a denial of service (system crash). The Qualys advisory [1] notes that this is one of several AppArmor vulnerabilities that could be chained for privilege escalation or defense bypass.

Mitigation

The fix, merged into the Linux kernel stable branches [2][3][4], rejects policies with out-of-bounds start states during unpacking. Users should apply the latest kernel updates from their distribution. No workaround is available; the vulnerability is patched in updated kernels.