CVE-2026-46254

What it actually does

This vulnerability affects the Linux kernel AppArmor policy parser path. AppArmor DFA policy tables may be supplied by the kernel or by userspace tooling such as apparmor_parser, but the vulnerable code assumes 8-byte alignment when unpacking those tables. On architectures that fault or warn on unaligned memory access, a locally supplied or malformed AppArmor profile can trigger unaligned memory accesses in aa_dfa_unpack(), potentially causing kernel warnings, instability, or denial of service. The impact is availability-focused; the provided CVSS vector indicates local access with low privileges, no user interaction, and no confidentiality or integrity impact.

Why it matters to the business

An attacker or misconfigured local process with the ability to load or replace AppArmor profiles could disrupt affected Linux systems, especially on architectures sensitive to unaligned memory access. The main operational risk is service interruption, host instability, or failed security-policy updates. Because this is not in CISA KEV, has no known ransomware association, has very low EPSS, and has no reported mature exploit, it is lower urgency than remotely exploitable kernel flaws, but still important for systems where AppArmor policy loading is delegated or automated.

How an attack unfolds

An attacker first obtains local access to an affected Linux host and identifies whether AppArmor is enabled and whether they can influence AppArmor policy loading or replacement. They then craft or provide an AppArmor policy blob containing DFA tables that are not aligned as the vulnerable kernel code expects. When the profile is loaded or replaced through the AppArmor policy interface, the kernel reaches aa_dfa_unpack() while unpacking the DFA blob. On affected architectures, the unaligned read can trigger kernel warnings and unaligned access faults, leading to degraded availability or a denial-of-service condition. There is no indication from the supplied data that this vulnerability enables privilege escalation, code execution, or data theft.

How to fix it

Update the Linux kernel to a vendor-supported version that includes the AppArmor fix to handle unaligned DFA tables using safe get_unaligned_xx() helpers. No exact fixed package versions were provided, so use distribution security advisories and kernel changelogs to identify the first fixed build for each platform. Where immediate patching is not possible, reduce exposure by limiting who can load or replace AppArmor profiles, restricting sudoers or automation paths that invoke apparmor_parser, disabling untrusted policy deployment pipelines, and monitoring attempts to write to AppArmor policy interfaces. Avoid disabling AppArmor as a primary mitigation unless directed by the operating system vendor, because doing so may reduce overall system hardening.

How to confirm the fix worked

Confirm the running kernel package contains the AppArmor unaligned-DFA-table fix from the operating system vendor. Validate with package-manager security metadata, kernel changelog entries referencing AppArmor unaligned DFA handling, or source-level confirmation that aa_dfa_unpack() uses unaligned-safe accessors. After patching, reboot into the fixed kernel where required and verify with uname -r and package inventory that the active kernel is the corrected build. Functional validation can include loading representative AppArmor profiles and confirming that kernel logs no longer show aa_dfa_unpack unaligned access warnings or dfa blob alignment messages.

Typical attack path

1. Gain local access to an affected Linux system.
2. Determine that AppArmor is enabled and that profile loading or replacement is possible.
3. Create or modify an AppArmor profile/policy blob with unaligned DFA table data.
4. Load or replace the AppArmor profile using apparmor_parser or the AppArmor policy interface.
5. Trigger the vulnerable aa_dfa_unpack() code path in the kernel.
6. Cause kernel warnings, unaligned access faults, service disruption, or host instability.

How to detect it

To determine whether this was already triggered, review kernel logs and system journals for AppArmor DFA unpacking warnings, unaligned access faults, and profile replacement activity. Useful sources include /var/log/kern.log, /var/log/syslog, /var/log/messages, dmesg output, journald kernel logs, auditd logs, sudo logs, and configuration-management or deployment logs that run apparmor_parser. Look for the process name apparmor_parser near kernel warnings involving aa_dfa_unpack(), policy_update(), profile_replace(), aa_replace_profiles(), or messages stating that a DFA blob stream was not aligned. Correlate these events with local user activity, sudo invocations, package upgrades, profile deployments, container runtime activity, and any host crashes or reboots. Because the vulnerability is local and availability-focused, strong evidence of exploitation is likely to be abnormal AppArmor profile load attempts immediately preceding kernel warnings, unaligned access faults, service disruption, or system instability rather than network indicators.

• aa_dfa_unpack
• dfa blob stream
• not aligned
• Kernel unaligned access
• apparmor_parser
• profile_replace
• policy_update
• aa_replace_profiles
• unpack_profile
• unpack_pdb
• security/apparmor/match.c
• WARNING: CPU
• Comm: apparmor_parser
• /sys/kernel/security/apparmor/.replace
• /sys/kernel/security/apparmor/.load

What your security team should do

• Inventory Linux systems using AppArmor, prioritizing architectures known to be sensitive to unaligned memory access and systems where AppArmor policies are frequently generated or updated.
• Patch affected kernels through normal Linux distribution security channels and ensure systems reboot into the fixed kernel.
• Restrict AppArmor policy loading and replacement permissions to trusted administrators and trusted automation only.
• Review sudoers, configuration-management jobs, container host tooling, and deployment pipelines for paths that can invoke apparmor_parser or modify AppArmor policy.
• Monitor kernel logs for AppArmor DFA unpacking warnings and unaligned access messages until remediation is complete.
• Treat unexpected AppArmor profile replacement activity as suspicious, especially when followed by kernel warnings, crashes, or host instability.