CVE-2026-23269
High · 7.1CVSS
7.1
EPSS
0.1%
Published
Mar 18, 2026
CISA due date
—
The record
In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read. ================================================================== BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360 Read of size 4 at addr ffff88811956fb90 by task su/1097 ... Reject policies with out-of-bounds start states during unpacking to prevent the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.92.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.92.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_21 | 0 | 1-150600.13.5.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-64kb | 0 | 6.4.0-150600.23.92.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-default | 0 | 6.4.0-150600.23.92.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-default-base | 0 | 6.4.0-150600.23.92.1.150600.12.42.2 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-docs | 0 | 6.4.0-150600.23.92.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-obs-build | 0 | 6.4.0-150600.23.92.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-source | 0 | 6.4.0-150600.23.92.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-syms | 0 | 6.4.0-150600.23.92.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-zfcpdump | 0 | 6.4.0-150600.23.92.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.92.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.92.1.150600.12.42.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.92.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.92.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.92.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.92.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.92.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.92.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.92.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.92.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.92.1.150600.12.42.2 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.92.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.92.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.92.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.92.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.92.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.92.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.92.1 |
Related vulnerabilities
- CVE-2026-23268 In the Linux kernel, the following vulnerability has been resolved: apparmor: fix… Also affects kernel-default
- CVE-2025-71231 In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix… Also affects kernel-default
- CVE-2026-23214 In the Linux kernel, the following vulnerability has been resolved: btrfs: reject new… Also affects kernel-default
- CVE-2026-23204 In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32… Also affects kernel-default
- CVE-2026-23207 In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad… Also affects kernel-default
- CVE-2026-23209 In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error… Also affects kernel-default
- CVE-2026-23202 In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad… Also affects kernel-default
- CVE-2026-23191 In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy… Also affects kernel-default