CVE-2026-23269: apparmor: validate DFA start states are in bounds in unpack_pdb

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-18 · updated 2026-06-17
Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read. ================================================================== BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360 Read of size 4 at addr ffff88811956fb90 by task su/1097 ... Reject policies with out-of-bounds start states during unpacking to prevent the issue.

Affected products

Linux kernel: from 3.4 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.169; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.18 — fixed in 5.10.253, 5.15.203, 6.1.169, 6.12.77, 6.18.18, 6.19.8

How to fix

Upgrade to a fixed version: Linux kernel 5.10.253, 5.15.203, 6.1.169, 6.12.77. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-23269 or the next vulnerability affects your stack