{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-23406", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.013Z", "datePublished": "2026-04-01T08:36:36.460Z", "dateUpdated": "2026-08-05T12:21:26.927Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:21:26.927Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix side-effect bug in match_char() macro usage\n\nThe match_char() macro evaluates its character parameter multiple\ntimes when traversing differential encoding chains. When invoked\nwith *str++, the string pointer advances on each iteration of the\ninner do-while loop, causing the DFA to check different characters\nat each iteration and therefore skip input characters.\nThis results in out-of-bounds reads when the pointer advances past\nthe input buffer boundary.\n\n[ 94.984676] ==================================================================\n[ 94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760\n[ 94.985655] Read of size 1 at addr ffff888100342000 by task file/976\n\n[ 94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[ 94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 94.986329] Call Trace:\n[ 94.986341] \n[ 94.986347] dump_stack_lvl+0x5e/0x80\n[ 94.986374] print_report+0xc8/0x270\n[ 94.986384] ? aa_dfa_match+0x5ae/0x760\n[ 94.986388] kasan_report+0x118/0x150\n[ 94.986401] ? aa_dfa_match+0x5ae/0x760\n[ 94.986405] aa_dfa_match+0x5ae/0x760\n[ 94.986408] __aa_path_perm+0x131/0x400\n[ 94.986418] aa_path_perm+0x219/0x2f0\n[ 94.986424] apparmor_file_open+0x345/0x570\n[ 94.986431] security_file_open+0x5c/0x140\n[ 94.986442] do_dentry_open+0x2f6/0x1120\n[ 94.986450] vfs_open+0x38/0x2b0\n[ 94.986453] ? may_open+0x1e2/0x2b0\n[ 94.986466] path_openat+0x231b/0x2b30\n[ 94.986469] ? __x64_sys_openat+0xf8/0x130\n[ 94.986477] do_file_open+0x19d/0x360\n[ 94.986487] do_sys_openat2+0x98/0x100\n[ 94.986491] __x64_sys_openat+0xf8/0x130\n[ 94.986499] do_syscall_64+0x8e/0x660\n[ 94.986515] ? count_memcg_events+0x15f/0x3c0\n[ 94.986526] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986540] ? handle_mm_fault+0x1639/0x1ef0\n[ 94.986551] ? vma_start_read+0xf0/0x320\n[ 94.986558] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986561] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986563] ? fpregs_assert_state_consistent+0x50/0xe0\n[ 94.986572] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986574] ? arch_exit_to_user_mode_prepare+0x9/0xb0\n[ 94.986587] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986588] ? irqentry_exit+0x3c/0x590\n[ 94.986595] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 94.986597] RIP: 0033:0x7fda4a79c3ea\n\nFix by extracting the character value before invoking match_char,\nensuring single evaluation per outer loop." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is triggered through the file open syscall (openat) which goes through AppArmor's DFA matching on file paths. This requires local system access.\nAC:L - The bug is deterministic — any file path that triggers a differential encoding chain traversal in the AppArmor DFA will cause character skipping and OOB reads. The attacker reliably triggers it by opening files on systems with standard AppArmor policies using differential encoding.\nPR:L - Any unprivileged local user confined by an AppArmor profile can trigger this by performing normal file operations (e.g., opening files). No special privileges are required.\nUI:N - No user interaction is needed. The attacker simply opens files, and AppArmor's DFA matching is triggered automatically as part of the security hook.\nS:U - The vulnerability is in the kernel's AppArmor security module and impacts kernel memory and kernel-enforced access control, all within the same security authority (kernel space).\nC:H - The OOB read accesses kernel slab memory past the input buffer boundary, potentially reading unbounded amounts of adjacent kernel heap data. While the data is used as DFA indices rather than returned directly, the permission decision outcome can serve as an oracle.\nI:H - The incorrect DFA matching (skipping input characters) causes AppArmor to evaluate the wrong path against policy rules, potentially allowing file access that should be denied — effectively a mandatory access control policy bypass.\nA:H - The OOB read can advance the pointer past the slab allocation and potentially into unmapped memory, causing a kernel crash as demonstrated by the KASAN slab-out-of-bounds report in the commit message." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "security/apparmor/match.c" ], "versions": [ { "version": "074c1cd798cb0b481d7eaa749b64aa416563c053", "lessThan": "c7dc56d8b37eda1396feeec3ab1c7ecee5eae31b", "status": "affected", "versionType": "git" }, { "version": "074c1cd798cb0b481d7eaa749b64aa416563c053", "lessThan": "f16f2e5936c0f5f0d11fdf10d2be3e47e7108e42", "status": "affected", "versionType": "git" }, { "version": "074c1cd798cb0b481d7eaa749b64aa416563c053", "lessThan": "1fc94f16098213d01e56c97feed9b3ecf0147a37", "status": "affected", "versionType": "git" }, { "version": "074c1cd798cb0b481d7eaa749b64aa416563c053", "lessThan": "5a184f7cbdeaad17e16dedf3c17d0cd622edfed8", "status": "affected", "versionType": "git" }, { "version": "074c1cd798cb0b481d7eaa749b64aa416563c053", "lessThan": "b73c1dff8a9d7eeaebabf8097a5b2de192f40913", "status": "affected", "versionType": "git" }, { "version": "074c1cd798cb0b481d7eaa749b64aa416563c053", "lessThan": "0510d1ba0976f97f521feb2b75b0572ea5df3ceb", "status": "affected", "versionType": "git" }, { "version": "074c1cd798cb0b481d7eaa749b64aa416563c053", "lessThan": "383b7270faf42564f133134c2fc3c24bbae52615", "status": "affected", "versionType": "git" }, { "version": "074c1cd798cb0b481d7eaa749b64aa416563c053", "lessThan": "8756b68edae37ff546c02091989a4ceab3f20abd", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "security/apparmor/match.c" ], "versions": [ { "version": "4.17", "status": "affected" }, { "version": "0", "lessThan": "4.17", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.169", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.77", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.18", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.8", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.10.253" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.15.203" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.1.169" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.6.130" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.12.77" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.18.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.19.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c7dc56d8b37eda1396feeec3ab1c7ecee5eae31b" }, { "url": "https://git.kernel.org/stable/c/f16f2e5936c0f5f0d11fdf10d2be3e47e7108e42" }, { "url": "https://git.kernel.org/stable/c/1fc94f16098213d01e56c97feed9b3ecf0147a37" }, { "url": "https://git.kernel.org/stable/c/5a184f7cbdeaad17e16dedf3c17d0cd622edfed8" }, { "url": "https://git.kernel.org/stable/c/b73c1dff8a9d7eeaebabf8097a5b2de192f40913" }, { "url": "https://git.kernel.org/stable/c/0510d1ba0976f97f521feb2b75b0572ea5df3ceb" }, { "url": "https://git.kernel.org/stable/c/383b7270faf42564f133134c2fc3c24bbae52615" }, { "url": "https://git.kernel.org/stable/c/8756b68edae37ff546c02091989a4ceab3f20abd" } ], "title": "apparmor: fix side-effect bug in match_char() macro usage", "x_generator": { "engine": "bippy-1.2.0" } } } }