PT-2026-26129 · Linux · Linux

Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-23269

Mitre

In the Linux kernel, the following vulnerability has been resolved:

apparmor: validate DFA start states are in bounds in unpack pdb

Start states are read from untrusted data and used as indexes into the DFA state tables. The aa dfa next() function call in unpack pdb() will access dfa->tables[YYTD ID BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read.

================================================================== BUG: KASAN: slab-out-of-bounds in aa dfa next+0x2a1/0x360 Read of size 4 at addr ffff88811956fb90 by task su/1097 ...

Reject policies with out-of-bounds start states during unpacking to prevent the issue.

Related Identifiers

CVE-2026-23269

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-23269 · Security Note
• https://git.kernel.org/stable/c/15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c · Note
• https://git.kernel.org/stable/c/9063d7e2615f4a7ab321de6b520e23d370e58816 · Note
• https://git.kernel.org/stable/c/0baadb0eece2c4d939db10d3c323b4652ac79a58 · Note
• https://git.kernel.org/stable/c/3bb7db43e32190c973d4019037cedb7895920184 · Note