CVE-2026-23269: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23269 Overview

CVE-2026-23269 is an out-of-bounds read vulnerability in the Linux kernel's AppArmor subsystem. The flaw resides in the unpack_pdb() function, which fails to validate that deterministic finite automaton (DFA) start states fall within bounds before using them as indexes into DFA state tables. The aa_dfa_next() call accesses dfa->tables[YYTD_ID_BASE][start], and a start state exceeding the number of DFA states triggers a slab-out-of-bounds read detected by Kernel Address Sanitizer (KASAN). The issue affects local attackers capable of loading AppArmor policies, with potential impacts on kernel memory confidentiality and system availability.

Critical Impact
A local attacker with policy-loading capability can trigger an out-of-bounds slab read in the kernel, leading to information disclosure or denial of service through kernel memory corruption pathways.

Affected Products

Linux kernel (AppArmor subsystem)
Linux distributions shipping vulnerable kernel versions with AppArmor enabled
Stable kernel branches receiving the referenced backport commits

Discovery Timeline

2026-03-18 - CVE-2026-23269 published to NVD
2026-04-18 - Last updated in NVD database

Technical Details for CVE-2026-23269

Vulnerability Analysis

The vulnerability resides in AppArmor's policy unpacking routines, specifically inside unpack_pdb(). AppArmor uses DFAs to evaluate policy decisions over file paths and other strings. Each DFA is serialized with a set of start states that are read from user-supplied policy data during load operations. The kernel uses these start states directly as array indexes into the DFA's transition tables without bounds checking.

When aa_dfa_next() is invoked with an attacker-controlled start value, it dereferences dfa->tables[YYTD_ID_BASE][start]. If start exceeds the legitimate state count, the read crosses adjacent slab allocations. KASAN reports this as a slab-out-of-bounds read of size 4. The condition is classified as Out-of-Bounds Read [CWE-125].

Root Cause

The root cause is missing input validation on untrusted policy data. The AppArmor policy parser trusts the start-state values embedded in serialized policies and propagates them into table lookups. Without verifying that each start state is less than the total number of states, the parser allows arbitrary in-kernel indexing.

Attack Vector

A local user with the CAP_MAC_ADMIN capability — or any process permitted to load AppArmor policies — can craft a malicious policy with out-of-range start states. Loading the policy triggers unpack_pdb(), which calls aa_dfa_next() and performs the out-of-bounds slab read. The result can be a kernel oops, leakage of adjacent kernel memory contents into subsequent policy decisions, or destabilization of the host.

No verified exploit code is publicly available. Refer to the Qualys Security Research Blog and the upstream commits for technical details of the parser logic and the fix.

Detection Methods for CVE-2026-23269

Indicators of Compromise

KASAN reports containing slab-out-of-bounds in aa_dfa_next in dmesg or /var/log/kern.log
Kernel oops or panic traces referencing unpack_pdb, aa_dfa_next, or unpack_dfa call paths
Unexpected AppArmor policy load failures from userspace tooling such as apparmor_parser

Detection Strategies

Audit kernel logs for AppArmor policy load events correlated with crash traces or sanitizer warnings
Monitor invocations of apparmor_parser and direct writes to /sys/kernel/security/apparmor/.load from non-administrative contexts
Inspect installed kernel package versions against the fixed commits listed in the upstream stable tree

Monitoring Recommendations

Forward kernel ring buffer messages and auditd AppArmor events to a centralized log platform for anomaly review
Alert on processes loading or replacing AppArmor profiles outside of approved configuration management workflows
Track CAP_MAC_ADMIN capability usage by non-root or container workloads where policy loading should not occur

How to Mitigate CVE-2026-23269

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution that incorporates the AppArmor unpack_pdb bounds-checking fix
Restrict the ability to load AppArmor policies to trusted administrators and remove CAP_MAC_ADMIN from untrusted workloads and containers
Inventory systems running AppArmor-enabled kernels and prioritize patching multi-tenant or shared hosts

Patch Information

Upstream fixes are merged across multiple stable branches. Reference commits include 07cf6320f40e, 0baadb0eece2, 15c3eb8916e7, 3bb7db43e321, 5443c027ec16, 5487871b2b56, 9063d7e2615f, and f43eea8ae010. The fix rejects policies that declare out-of-bounds start states during unpacking.

Workarounds

Disable the AppArmor LSM at boot using kernel parameter apparmor=0 on systems that do not require it
Constrain container runtimes to drop CAP_MAC_ADMIN and prevent unprivileged profile loading
Limit access to /sys/kernel/security/apparmor/.load and /sys/kernel/security/apparmor/.replace to trusted accounts only

bash

# Verify kernel version and AppArmor status, then drop policy-load capability for containers
uname -r
aa-status

# Example: run a container without MAC_ADMIN to prevent malicious profile loads
docker run --cap-drop=MAC_ADMIN --security-opt apparmor=docker-default <image>