|
Vulnerabilities
< Back

CVE-2026-23268

Updated on 18 Mar 2026

Severity

Awaiting Analysis

Details

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix unprivileged local user can do privileged policy management

An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by passing the opened fd to a privileged process, and getting the privileged process to write to the interface.

This does require a privileged target that can be manipulated to do the write for the unprivileged process, but once such access is achieved full policy management is possible and all the possible implications that implies: removing confinement, DoS of system or target applications by denying all execution, by-passing the unprivileged user namespace restriction, to exploiting kernel bugs for a local privilege escalation.

The policy management interface can not have its permissions simply changed from 0666 to 0600 because non-root processes need to be able to load policy to different policy namespaces.

Instead ensure the task writing the interface has privileges that are a subset of the task that opened the interface. This is already done via policy for confined processes, but unconfined can delegate access to the opened fd, by-passing the usual policy check.

Details

Affected product:
AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , Debian 10 ELS , Oracle Linux 7 ELS , TuxCare 9.6 ESU , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS
Affected packages:
linux @ 5.4.0 (+10 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Debian 11 Released
37 kernels
  • 5.10.46-5
  • 5.10.70-1
  • 5.10.46-4
  • 5.10.84-1
  • 5.10.92-1
  • 5.10.92-2
  • 5.10.103-1
  • 5.10.106-1
  • 5.10.113-1
  • 5.10.120-1
  • 5.10.127-1
  • 5.10.127-2
  • 5.10.136-1
  • 5.10.140-1
  • 5.10.149-1
  • 5.10.149-2
  • 5.10.158-2
  • 5.10.162-1
  • 5.10.179-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.178-3
  • 5.10.205-2
  • 5.10.205-1
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
Debian 11 cloud Released
17 kernels
  • 5.10.113-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.205-2
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
Debian 12 Released
34 kernels
  • 6.1.38-1
  • 6.1.38-2
  • 6.1.38-4
  • 6.1.52-1
  • 6.1.55-1
  • 6.1.64-1
  • 6.1.66-1
  • 6.1.69-1
  • 6.1.76-1
  • 6.1.27-1
  • 6.1.67-1
  • 6.1.85-1
  • 6.1.90-1
  • 6.1.94-1
  • 6.1.99-1
  • 6.1.106-3
  • 6.1.112-1
  • 6.1.115-1
  • 6.1.119-1
  • 6.1.123-1
  • 6.1.128-1
  • 6.1.124-1
  • 6.1.129-1
  • 6.1.133-1
  • 6.1.135-1
  • 6.1.137-1
  • 6.1.140-1
  • 6.1.139-1
  • 6.1.147-1
  • 6.1.148-1
  • 6.1.153-1
  • 6.1.158-1
  • 6.1.159-1
  • 6.1.162-1
Debian 13 Ready For Release —
Ubuntu 16.04 AWS HWE ESM Planned —
Ubuntu 16.04 GCP ESM Planned —
Ubuntu 16.04 HWE ESM Planned —
Ubuntu 18.04 Planned —
Ubuntu 18.04 AWS Planned —
Ubuntu 18.04 Azure Planned —
Ubuntu 18.04 GCP Planned —
Ubuntu 20.04 Released
32 kernels
  • 5.4.0-165.182
  • 5.4.0-166.183
  • 5.4.0-167.184
  • 5.4.0-169.187
  • 5.4.0-170.188
  • 5.4.0-171.189
  • 5.4.0-172.190
  • 5.4.0-173.191
  • 5.4.0-174.193
  • 5.4.0-176.196
  • 5.4.0-177.197
  • 5.4.0-181.201
  • 5.4.0-182.202
  • 5.4.0-186.206
  • 5.4.0-187.207
  • 5.4.0-189.209
  • 5.4.0-190.210
  • 5.4.0-192.212
  • 5.4.0-193.213
  • 5.4.0-195.215
  • 5.4.0-196.216
  • 5.4.0-198.218
  • 5.4.0-200.220
  • 5.4.0-202.222
  • 5.4.0-204.224
  • 5.4.0-205.225
  • 5.4.0-208.228
  • 5.4.0-211.231
  • 5.4.0-212.232
  • 5.4.0-214.234
  • 5.4.0-215.235
  • 5.4.0-216.236
Ubuntu 20.04 AWS Released
31 kernels
  • 5.4.0-1112.121
  • 5.4.0-1113.123
  • 5.4.0-1114.124
  • 5.4.0-1116.126
  • 5.4.0-1117.127
  • 5.4.0-1118.128
  • 5.4.0-1119.129
  • 5.4.0-1120.130
  • 5.4.0-1121.131
  • 5.4.0-1122.132
  • 5.4.0-1123.133
  • 5.4.0-1124.134
  • 5.4.0-1125.135
  • 5.4.0-1126.136
  • 5.4.0-1127.137
  • 5.4.0-1128.138
  • 5.4.0-1129.139
  • 5.4.0-1130.140
  • 5.4.0-1131.141
  • 5.4.0-1132.142
  • 5.4.0-1133.143
  • 5.4.0-1134.144
  • 5.4.0-1135.145
  • 5.4.0-1136.146
  • 5.4.0-1137.147
  • 5.4.0-1139.149
  • 5.4.0-1140.150
  • 5.4.0-1142.152
  • 5.4.0-1144.154
  • 5.4.0-1145.155
  • 5.4.0-1146.156
Ubuntu 20.04 Azure Released
30 kernels
  • 5.4.0-1118.125
  • 5.4.0-1119.126
  • 5.4.0-1120.127
  • 5.4.0-1121.128
  • 5.4.0-1122.129
  • 5.4.0-1123.130
  • 5.4.0-1124.131
  • 5.4.0-1126.133
  • 5.4.0-1127.134
  • 5.4.0-1128.135
  • 5.4.0-1129.136
  • 5.4.0-1130.137
  • 5.4.0-1131.138
  • 5.4.0-1132.139
  • 5.4.0-1133.140
  • 5.4.0-1134.141
  • 5.4.0-1135.142
  • 5.4.0-1136.143
  • 5.4.0-1137.144
  • 5.4.0-1138.145
  • 5.4.0-1139.146
  • 5.4.0-1140.147
  • 5.4.0-1142.149
  • 5.4.0-1143.150
  • 5.4.0-1145.152
  • 5.4.0-1147.154
  • 5.4.0-1148.155
  • 5.4.0-1149.156
  • 5.4.0-1150.157
  • 5.4.0-1151.158
Ubuntu 24.04 Released
39 kernels
  • 6.8.0-35.35
  • 6.8.0-38.38
  • 6.8.0-36.36
  • 6.8.0-39.39
  • 6.8.0-40.40
  • 6.8.0-41.41
  • 6.8.0-44.44
  • 6.8.0-45.45
  • 6.8.0-31.31
  • 6.8.0-47.47
  • 6.8.0-48.48
  • 6.8.0-49.49
  • 6.8.0-50.51
  • 6.8.0-51.52
  • 6.8.0-52.53
  • 6.8.0-54.56
  • 6.8.0-55.57
  • 6.8.0-53.55
  • 6.8.0-56.58
  • 6.8.0-57.59
  • 6.8.0-58.60
  • 6.8.0-59.61
  • 6.8.0-60.63
  • 6.8.0-62.65
  • 6.8.0-63.66
  • 6.8.0-64.67
  • 6.8.0-71.71
  • 6.8.0-78.78
  • 6.8.0-79.79
  • 6.8.0-84.84
  • 6.8.0-85.85
  • 6.8.0-83.83
  • 6.8.0-86.87
  • 6.8.0-87.88
  • 6.8.0-88.89
  • 6.8.0-90.91
  • 6.8.0-94.96
  • 6.8.0-100.100
  • 6.8.0-101.101