Riskcovery

CVE-2026-23269

apparmor: validate DFA start states are in bounds in unpack_pdb

State
Published
Severity
7.1 High
Published
Mar 18, 2026
Updated
Aug 5, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: validate DFA start states are in bounds in unpack_pdb

Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read.

================================================================== BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360 Read of size 4 at addr ffff88811956fb90 by task su/1097 ...

Reject policies with out-of-bounds start states during unpacking to prevent the issue.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ad5ff3db53c68c2f12936bc74ea5dfe0af943592 to before f43eea8ae0102ea198da211ef7f5ce83725ecf19Affected
  • ad5ff3db53c68c2f12936bc74ea5dfe0af943592 to before 5487871b2b56c19d26936ed6fdc62652b30941dfAffected
  • ad5ff3db53c68c2f12936bc74ea5dfe0af943592 to before 5443c027ec16afa55b1b8a3e7a1ab2ea3c77767aAffected
  • ad5ff3db53c68c2f12936bc74ea5dfe0af943592 to before 07cf6320f40ea2ccfad63728cff34ecb309d03daAffected
  • ad5ff3db53c68c2f12936bc74ea5dfe0af943592 to before 15c3eb8916e7db01cb246d04a1fe6f0fdc065b0cAffected
  • ad5ff3db53c68c2f12936bc74ea5dfe0af943592 to before 0baadb0eece2c4d939db10d3c323b4652ac79a58Affected
  • ad5ff3db53c68c2f12936bc74ea5dfe0af943592 to before 3bb7db43e32190c973d4019037cedb7895920184Affected
  • ad5ff3db53c68c2f12936bc74ea5dfe0af943592 to before 9063d7e2615f4a7ab321de6b520e23d370e58816Affected
LinuxLinux
  • 3.4Affected
  • before 3.4Not affected
  • 5.10.253 through 5.10.*Not affected
  • 5.15.203 through 5.15.*Not affected
  • 6.1.169 through 6.1.*Not affected
  • 6.6.130 through 6.6.*Not affected
  • 6.12.77 through 6.12.*Not affected
  • 6.18.18 through 6.18.*Not affected
  • 6.19.8 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.