High 7.1Published Mar 18, 2026

CVE-2026-23269apparmor: validate DFA start states are in bounds in unpack_pdb

Updated under an hour ago (Oct 27, 2026, 8:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read. ================================================================== BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360 Read of size 4 at addr ffff88811956fb90 by task su/1097 ... Reject policies with out-of-bounds start states during unpacking to prevent the issue.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ad5ff3db53c68c2f12936bc74ea5dfe0af943592 before f43eea8ae0102ea198da211ef7f5ce83725ecf19; from ad5ff3db53c68c2f12936bc74ea5dfe0af943592 before 5487871b2b56c19d26936ed6fdc62652b30941df; from ad5ff3db53c68c2f12936bc74ea5dfe0af943592 before 5443c027ec16afa55b1b8a3e7a1ab2ea3c77767a; from ad5ff3db53c68c2f12936bc74ea5dfe0af943592 before 07cf6320f40ea2ccfad63728cff34ecb309d03da; from ad5ff3db53c68c2f12936bc74ea5dfe0af943592 before 15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c; from ad5ff3db53c68c2f12936bc74ea5dfe0af943592 before 0baadb0eece2c4d939db10d3c323b4652ac79a58; from ad5ff3db53c68c2f12936bc74ea5dfe0af943592 before 3bb7db43e32190c973d4019037cedb7895920184; from ad5ff3db53c68c2f12936bc74ea5dfe0af943592 before 9063d7e2615f4a7ab321de6b520e23d370e58816	CNA record
linux linux_kernel linux:linux_kernel	from 3.4 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.169; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.18; from 6.19 before 6.19.8; 7.0; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/f43eea8ae0102ea198da211ef7f5ce83725ecf19	patch
https://git.kernel.org/stable/c/5487871b2b56c19d26936ed6fdc62652b30941df	patch
https://git.kernel.org/stable/c/5443c027ec16afa55b1b8a3e7a1ab2ea3c77767a	patch
https://git.kernel.org/stable/c/07cf6320f40ea2ccfad63728cff34ecb309d03da	patch
https://git.kernel.org/stable/c/15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c	patch
https://git.kernel.org/stable/c/0baadb0eece2c4d939db10d3c323b4652ac79a58	patch
https://git.kernel.org/stable/c/3bb7db43e32190c973d4019037cedb7895920184	patch
https://git.kernel.org/stable/c/9063d7e2615f4a7ab321de6b520e23d370e58816	patch
https://www.qualys.com/2026/03/10/crack-armor.txt	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.