Security readout for executives and security teams
Plain-English summary
A local user with existing low-level access may trigger faulty AppArmor policy processing, causing the Linux kernel to read beyond allocated memory. The assessed consequences include substantial information exposure or system disruption, but the supplied evidence does not establish remote attackability or privilege escalation.
Executive priority
Treat as a high-priority kernel update, especially on shared, multi-user, or locally accessible Linux systems using AppArmor. It is not documented as remotely exploitable or actively exploited, so prioritize according to local-user exposure while promptly following distribution guidance.
Technical view
AppArmor's unpack_pdb() accepted an untrusted DFA start state without confirming it was within the state table. aa_dfa_next() then used that value as an index, producing a kernel slab out-of-bounds read. The published CVSS 3.1 score is 7.1 with local, low-privilege access and high confidentiality and availability impact.
Likely exposure
Exposure is most relevant to Linux systems using AppArmor where a low-privileged local actor can cause attacker-controlled policy data to be unpacked. Internet exposure alone does not satisfy the published local attack vector. The bundle's version data is insufficiently clear for precise distribution-level conclusions.
Exploitation context
The supplied record marks this CVE as absent from KEV and provides no evidence of active exploitation. A Qualys research reference is listed, but its contents and conclusions are not included in the bundle; therefore, public exploit reliability and observed attacks cannot be determined here.
Researcher notes
The bundle documents a four-byte KASAN slab out-of-bounds read in aa_dfa_next(), reached through unpack_pdb(). Stable-kernel fix commits are provided. Exact affected ranges require vendor confirmation because the supplied version data is broad and includes repeated hashes; no integrity impact, code execution, or privilege escalation is established.
Mitigation direction
- Install a vendor kernel update incorporating the applicable listed stable fix.
- Reboot into the updated kernel and confirm the running version changed.
- Prioritize multi-user or shared systems where untrusted local users have access.
- Consult distribution guidance before considering temporary AppArmor configuration changes.
Validation and detection
- Inventory running kernels and identify systems where AppArmor is enabled.
- Compare each distribution kernel against its vendor advisory and backported fix status.
- Confirm the running kernel after reboot, not only the installed package version.
- Review kernel logs for AppArmor-related crashes or out-of-bounds memory reports.
Public sources used
- CVE Program record for CVE-2026-23269
- CVE List V5 record
- Linux stable fix f43eea8ae010
- Linux stable fix 5487871b2b56
- Linux stable fix 5443c027ec16
- Linux stable fix 07cf6320f40e
- Linux stable fix 15c3eb8916e7
- Linux stable fix 0baadb0eece2
- Linux stable fix 3bb7db43e321
- Linux stable fix 9063d7e2615f
- Qualys Crack Armor research reference
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23269 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f43eea8ae0102ea198da211ef7f5ce83725ecf19CVE reference, Linux
- https://git.kernel.org/stable/c/5487871b2b56c19d26936ed6fdc62652b30941dfCVE reference, Linux
- https://git.kernel.org/stable/c/5443c027ec16afa55b1b8a3e7a1ab2ea3c77767aCVE reference, Linux
- https://git.kernel.org/stable/c/07cf6320f40ea2ccfad63728cff34ecb309d03daCVE reference, Linux
- https://git.kernel.org/stable/c/15c3eb8916e7db01cb246d04a1fe6f0fdc065b0cCVE reference, Linux
- https://git.kernel.org/stable/c/0baadb0eece2c4d939db10d3c323b4652ac79a58CVE reference, Linux
- https://git.kernel.org/stable/c/3bb7db43e32190c973d4019037cedb7895920184CVE reference, Linux
- https://git.kernel.org/stable/c/9063d7e2615f4a7ab321de6b520e23d370e58816CVE reference, Linux
- https://www.qualys.com/2026/03/10/crack-armor.txtCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.