CVE-2026-46055

What it actually does

This flaw is a local Linux kernel memory-safety issue in AppArmor mount mediation. A missing string terminator can cause AppArmor's DFA matching logic, specifically aa_dfa_match(), to read beyond the end of an allocated kernel buffer while processing mount-related paths. The observed failure is a slab out-of-bounds read in the AppArmor mount path matching path, triggered during mount handling. Depending on kernel configuration and runtime conditions, the impact may include kernel information disclosure through out-of-bounds reads and system instability or denial of service if the fault is detected by memory sanitizers or results in a kernel crash. The CVSS vector indicates local access, low attack complexity, low privileges required, no user interaction, high confidentiality impact, and high availability impact, with no direct integrity impact.

Why it matters to the business

An attacker or compromised local user/process with the ability to exercise mount operations could potentially crash affected Linux systems or expose sensitive kernel memory. This is most relevant to servers, workstations, container hosts, and endpoint systems that rely on AppArmor for mandatory access control, particularly distributions or configurations where AppArmor mount mediation is enabled. Although the vulnerability is not currently listed in CISA KEV, has no known exploit maturity, and has a low EPSS score, kernel flaws can have high operational consequences because successful exploitation may affect the stability and confidentiality of the entire host.

How an attack unfolds

An attacker first obtains local code execution with low privileges on an affected Linux system. They then trigger AppArmor's mount mediation path by causing a mount or bind-mount operation to be evaluated under an AppArmor profile. By supplying mount-related path data that reaches the vulnerable string handling path without proper termination, the kernel's AppArmor DFA matcher reads one byte or more beyond the allocated buffer boundary. In hardened or instrumented kernels this may generate a KASAN slab-out-of-bounds report; in production kernels the outcome may be silent memory disclosure, a kernel fault, or system instability. There is no indication from the provided data that this vulnerability is remotely exploitable, used in ransomware, or currently exploited by named threat actors.

How to fix it

Apply the vendor-provided Linux kernel update that includes the AppArmor fix for the missing string termination issue. Because no exact fixed kernel versions were provided in the input, use distribution advisories and package metadata for the authoritative patched version for each affected platform. Prioritize systems where AppArmor is enabled, untrusted local users are present, container workloads can perform namespace or mount-related operations, or local privilege boundaries are security-critical. If immediate patching is not possible, reduce exposure by limiting local shell access, restricting untrusted workloads, tightening container runtime privileges, disabling unnecessary mount capabilities, avoiding privileged containers, and reviewing AppArmor profiles that permit mount operations. Disabling AppArmor may avoid the vulnerable code path but is generally not recommended because it removes an important security control; prefer patching or reducing mount-related privileges instead.

How to confirm the fix worked

Confirm that affected systems are running a kernel build from the operating system vendor that contains the AppArmor string termination fix. Validate package status with distribution-specific tooling such as uname -a, package manager changelogs, vendor advisory references, and kernel package version checks. Confirm AppArmor status with apparmor_status or equivalent tools and identify whether mount rules are used in active profiles. After remediation, reproduce benign mount or namespace workflows that previously exercised AppArmor mount mediation and verify that no kernel warnings, KASAN reports, oopses, or AppArmor-related mount matching errors appear in dmesg, journalctl -k, or /var/log/kern.log. For high-assurance validation, test patched kernels in staging with representative container, snap, namespace, and bind-mount workloads.

Typical attack path

1. Gain local execution on an affected Linux system as an unprivileged or low-privileged user/process.
2. Identify that AppArmor is enabled and that mount mediation is active for the process context or profile being targeted.
3. Trigger mount or bind-mount handling through a permitted local code path, helper, namespace operation, container runtime path, or confined application behavior.
4. Craft mount-related path input that reaches AppArmor string matching without the expected null termination.
5. Cause AppArmor's aa_dfa_match() logic to read past the end of the allocated kernel buffer.
6. Leverage the resulting behavior for kernel memory disclosure or denial of service, depending on system configuration and exploit reliability.

How to detect it

To determine whether the vulnerability may already have been triggered, review kernel logs and system journals for AppArmor mount mediation crashes, KASAN slab out-of-bounds reports, kernel oopses, or panics referencing aa_dfa_match, match_mnt_path_str, aa_bind_mount, apparmor_sb_mount, or security_sb_mount. Useful sources include dmesg output, journalctl -k, /var/log/kern.log, /var/log/syslog, crash dumps, kdump/vmcore artifacts, and endpoint telemetry that records kernel panic or process crash context. Pay attention to events involving local processes that perform mount or namespace operations, including snap-update-ns, container runtimes, sandboxing tools, package lifecycle helpers, or processes running under AppArmor confinement. There are no known threat actors or public exploitation campaigns in the provided data, so detection should focus on behavioral evidence of the vulnerable code path being exercised rather than known attacker infrastructure.

• BUG: KASAN: slab-out-of-bounds in aa_dfa_match
• Read of size 1 at addr
• aa_dfa_match
• match_mnt_path_str
• match_mnt
• aa_bind_mount
• apparmor_sb_mount
• security_sb_mount
• path_mount
• __arm64_sys_mount
• aa_get_buffer
• snap-update-ns
• kasan: bad access detected
• kmalloc-rnd-06-8k
• slab-out-of-bounds
• AppArmor
• apparmor

What your security team should do

• Inventory Linux systems using AppArmor, especially Ubuntu and other distributions with AppArmor enabled by default.
• Prioritize patching systems that allow local interactive users, run multi-tenant workloads, host containers, or execute untrusted code.
• Track distribution advisories for the exact fixed kernel package versions and deploy the patched kernel through normal kernel update channels.
• Reboot systems after kernel update installation so the fixed kernel is actually running.
• Review container and workload configurations for unnecessary mount, bind-mount, namespace, SYS_ADMIN, or privileged-container capabilities.
• Monitor kernel logs for AppArmor, KASAN, slab out-of-bounds, or aa_dfa_match crash signatures as possible exploitation or probing evidence.
• Do not rely on the low EPSS score alone to defer remediation on high-value or multi-user Linux systems, because the vulnerability has high confidentiality and availability impact if exploited locally.