GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23407 (GCVE-0-2026-23407)

Vulnerability from cvelistv5 – Published: 2026-04-01 08:36 – Updated: 2026-08-05 12:21
VLAI
Title
apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
Summary
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix missing bounds check on DEFAULT table in verify_dfa() The verify_dfa() function only checks DEFAULT_TABLE bounds when the state is not differentially encoded. When the verification loop traverses the differential encoding chain, it reads k = DEFAULT_TABLE[j] and uses k as an array index without validation. A malformed DFA with DEFAULT_TABLE[j] >= state_count, therefore, causes both out-of-bounds reads and writes. [ 57.179855] ================================================================== [ 57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660 [ 57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993 [ 57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy) [ 57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 57.181563] Call Trace: [ 57.181572] <TASK> [ 57.181577] dump_stack_lvl+0x5e/0x80 [ 57.181596] print_report+0xc8/0x270 [ 57.181605] ? verify_dfa+0x59a/0x660 [ 57.181608] kasan_report+0x118/0x150 [ 57.181620] ? verify_dfa+0x59a/0x660 [ 57.181623] verify_dfa+0x59a/0x660 [ 57.181627] aa_dfa_unpack+0x1610/0x1740 [ 57.181629] ? __kmalloc_cache_noprof+0x1d0/0x470 [ 57.181640] unpack_pdb+0x86d/0x46b0 [ 57.181647] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181653] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181656] ? aa_unpack_nameX+0x1a8/0x300 [ 57.181659] aa_unpack+0x20b0/0x4c30 [ 57.181662] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181664] ? stack_depot_save_flags+0x33/0x700 [ 57.181681] ? kasan_save_track+0x4f/0x80 [ 57.181683] ? kasan_save_track+0x3e/0x80 [ 57.181686] ? __kasan_kmalloc+0x93/0xb0 [ 57.181688] ? __kvmalloc_node_noprof+0x44a/0x780 [ 57.181693] ? aa_simple_write_to_buffer+0x54/0x130 [ 57.181697] ? policy_update+0x154/0x330 [ 57.181704] aa_replace_profiles+0x15a/0x1dd0 [ 57.181707] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181710] ? __kvmalloc_node_noprof+0x44a/0x780 [ 57.181712] ? aa_loaddata_alloc+0x77/0x140 [ 57.181715] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181717] ? _copy_from_user+0x2a/0x70 [ 57.181730] policy_update+0x17a/0x330 [ 57.181733] profile_replace+0x153/0x1a0 [ 57.181735] ? rw_verify_area+0x93/0x2d0 [ 57.181740] vfs_write+0x235/0xab0 [ 57.181745] ksys_write+0xb0/0x170 [ 57.181748] do_syscall_64+0x8e/0x660 [ 57.181762] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.181765] RIP: 0033:0x7f6192792eb2 Remove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE entries unconditionally.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 555829fd91eaf0711e369b0a92aecb0f0aa3281f (git)
Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c (git)
Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 22094c996968a7c5b59cd3fc9fcbdfdd46d02fec (git)
Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 7c7cf05e0606f554c467e3a4dc49e2e578a755b4 (git)
Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 76b4d36c5122866452d34d8f79985e191f9c3831 (git)
Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < 5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc (git)
Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed (git)
Affected: 031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3 , < d352873bbefa7eb39995239d0b44ccdf8aaa79a4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.10.253 , ≤ 5.10.* (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.169 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.77 , ≤ 6.12.* (semver)
Unaffected: 6.18.18 , ≤ 6.18.* (semver)
Unaffected: 6.19.8 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "555829fd91eaf0711e369b0a92aecb0f0aa3281f",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "22094c996968a7c5b59cd3fc9fcbdfdd46d02fec",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "7c7cf05e0606f554c467e3a4dc49e2e578a755b4",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "76b4d36c5122866452d34d8f79985e191f9c3831",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            },
            {
              "lessThan": "d352873bbefa7eb39995239d0b44ccdf8aaa79a4",
              "status": "affected",
              "version": "031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/match.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix missing bounds check on DEFAULT table in verify_dfa()\n\nThe verify_dfa() function only checks DEFAULT_TABLE bounds when the state\nis not differentially encoded.\n\nWhen the verification loop traverses the differential encoding chain,\nit reads k = DEFAULT_TABLE[j] and uses k as an array index without\nvalidation. A malformed DFA with DEFAULT_TABLE[j] \u003e= state_count,\ntherefore, causes both out-of-bounds reads and writes.\n\n[   57.179855] ==================================================================\n[   57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660\n[   57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993\n\n[   57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[   57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   57.181563] Call Trace:\n[   57.181572]  \u003cTASK\u003e\n[   57.181577]  dump_stack_lvl+0x5e/0x80\n[   57.181596]  print_report+0xc8/0x270\n[   57.181605]  ? verify_dfa+0x59a/0x660\n[   57.181608]  kasan_report+0x118/0x150\n[   57.181620]  ? verify_dfa+0x59a/0x660\n[   57.181623]  verify_dfa+0x59a/0x660\n[   57.181627]  aa_dfa_unpack+0x1610/0x1740\n[   57.181629]  ? __kmalloc_cache_noprof+0x1d0/0x470\n[   57.181640]  unpack_pdb+0x86d/0x46b0\n[   57.181647]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181653]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181656]  ? aa_unpack_nameX+0x1a8/0x300\n[   57.181659]  aa_unpack+0x20b0/0x4c30\n[   57.181662]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181664]  ? stack_depot_save_flags+0x33/0x700\n[   57.181681]  ? kasan_save_track+0x4f/0x80\n[   57.181683]  ? kasan_save_track+0x3e/0x80\n[   57.181686]  ? __kasan_kmalloc+0x93/0xb0\n[   57.181688]  ? __kvmalloc_node_noprof+0x44a/0x780\n[   57.181693]  ? aa_simple_write_to_buffer+0x54/0x130\n[   57.181697]  ? policy_update+0x154/0x330\n[   57.181704]  aa_replace_profiles+0x15a/0x1dd0\n[   57.181707]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181710]  ? __kvmalloc_node_noprof+0x44a/0x780\n[   57.181712]  ? aa_loaddata_alloc+0x77/0x140\n[   57.181715]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181717]  ? _copy_from_user+0x2a/0x70\n[   57.181730]  policy_update+0x17a/0x330\n[   57.181733]  profile_replace+0x153/0x1a0\n[   57.181735]  ? rw_verify_area+0x93/0x2d0\n[   57.181740]  vfs_write+0x235/0xab0\n[   57.181745]  ksys_write+0xb0/0x170\n[   57.181748]  do_syscall_64+0x8e/0x660\n[   57.181762]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   57.181765] RIP: 0033:0x7f6192792eb2\n\nRemove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE\nentries unconditionally."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by writing a crafted AppArmor policy to the securityfs interface (`/sys/kernel/security/apparmor/.load` or `.replace`), which requires local system access.\nAC:L - The attacker fully controls the malformed DFA data (DEFAULT_TABLE entries) supplied in the crafted policy. No race conditions or unpredictable conditions are involved \u2014 the OOB access is deterministic.\nPR:L - AppArmor policy loading requires CAP_MAC_ADMIN, but the kernel default `unprivileged_userns_apparmor_policy=1` allows this capability to be obtained via unprivileged user namespaces, making it reachable by an unprivileged local user.\nUI:N - No user interaction is required; the attacker can craft and load the malicious AppArmor policy entirely on their own.\nS:U - The vulnerability results in kernel heap corruption within the same security authority (kernel space). No virtualization or sandbox boundary is crossed.\nC:H - The OOB read from `DEFAULT_TABLE(dfa)[j]` and `BASE_TABLE(dfa)[j]` allows reading arbitrary kernel heap memory beyond the allocated DFA tables, enabling kernel address/data disclosure.\nI:H - The OOB write via `BASE_TABLE(dfa)[j] |= MARK_DIFF_ENCODE` corrupts kernel heap memory at attacker-controlled offsets, providing a write primitive that could be leveraged for code execution.\nA:H - The OOB memory access causes kernel oops/crash as demonstrated by the KASAN report, resulting in system denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:21:28.162Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/555829fd91eaf0711e369b0a92aecb0f0aa3281f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/22094c996968a7c5b59cd3fc9fcbdfdd46d02fec"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c7cf05e0606f554c467e3a4dc49e2e578a755b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/76b4d36c5122866452d34d8f79985e191f9c3831"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/d352873bbefa7eb39995239d0b44ccdf8aaa79a4"
        }
      ],
      "title": "apparmor: fix missing bounds check on DEFAULT table in verify_dfa()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23407",
    "datePublished": "2026-04-01T08:36:37.197Z",
    "dateReserved": "2026-01-13T15:37:46.013Z",
    "dateUpdated": "2026-08-05T12:21:28.162Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23407",
      "date": "2026-09-16",
      "epss": "0.00181",
      "percentile": "0.07932"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23407\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-01T09:16:16.527\",\"lastModified\":\"2026-06-17T10:21:31.340\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\napparmor: fix missing bounds check on DEFAULT table in verify_dfa()\\n\\nThe verify_dfa() function only checks DEFAULT_TABLE bounds when the state\\nis not differentially encoded.\\n\\nWhen the verification loop traverses the differential encoding chain,\\nit reads k = DEFAULT_TABLE[j] and uses k as an array index without\\nvalidation. A malformed DFA with DEFAULT_TABLE[j] \u003e= state_count,\\ntherefore, causes both out-of-bounds reads and writes.\\n\\n[   57.179855] ==================================================================\\n[   57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660\\n[   57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993\\n\\n[   57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\\n[   57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n[   57.181563] Call Trace:\\n[   57.181572]  \u003cTASK\u003e\\n[   57.181577]  dump_stack_lvl+0x5e/0x80\\n[   57.181596]  print_report+0xc8/0x270\\n[   57.181605]  ? verify_dfa+0x59a/0x660\\n[   57.181608]  kasan_report+0x118/0x150\\n[   57.181620]  ? verify_dfa+0x59a/0x660\\n[   57.181623]  verify_dfa+0x59a/0x660\\n[   57.181627]  aa_dfa_unpack+0x1610/0x1740\\n[   57.181629]  ? __kmalloc_cache_noprof+0x1d0/0x470\\n[   57.181640]  unpack_pdb+0x86d/0x46b0\\n[   57.181647]  ? srso_alias_return_thunk+0x5/0xfbef5\\n[   57.181653]  ? srso_alias_return_thunk+0x5/0xfbef5\\n[   57.181656]  ? aa_unpack_nameX+0x1a8/0x300\\n[   57.181659]  aa_unpack+0x20b0/0x4c30\\n[   57.181662]  ? srso_alias_return_thunk+0x5/0xfbef5\\n[   57.181664]  ? stack_depot_save_flags+0x33/0x700\\n[   57.181681]  ? kasan_save_track+0x4f/0x80\\n[   57.181683]  ? kasan_save_track+0x3e/0x80\\n[   57.181686]  ? __kasan_kmalloc+0x93/0xb0\\n[   57.181688]  ? __kvmalloc_node_noprof+0x44a/0x780\\n[   57.181693]  ? aa_simple_write_to_buffer+0x54/0x130\\n[   57.181697]  ? policy_update+0x154/0x330\\n[   57.181704]  aa_replace_profiles+0x15a/0x1dd0\\n[   57.181707]  ? srso_alias_return_thunk+0x5/0xfbef5\\n[   57.181710]  ? __kvmalloc_node_noprof+0x44a/0x780\\n[   57.181712]  ? aa_loaddata_alloc+0x77/0x140\\n[   57.181715]  ? srso_alias_return_thunk+0x5/0xfbef5\\n[   57.181717]  ? _copy_from_user+0x2a/0x70\\n[   57.181730]  policy_update+0x17a/0x330\\n[   57.181733]  profile_replace+0x153/0x1a0\\n[   57.181735]  ? rw_verify_area+0x93/0x2d0\\n[   57.181740]  vfs_write+0x235/0xab0\\n[   57.181745]  ksys_write+0xb0/0x170\\n[   57.181748]  do_syscall_64+0x8e/0x660\\n[   57.181762]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n[   57.181765] RIP: 0033:0x7f6192792eb2\\n\\nRemove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE\\nentries unconditionally.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"security/apparmor/match.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3\",\"lessThan\":\"555829fd91eaf0711e369b0a92aecb0f0aa3281f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3\",\"lessThan\":\"a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3\",\"lessThan\":\"22094c996968a7c5b59cd3fc9fcbdfdd46d02fec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3\",\"lessThan\":\"7c7cf05e0606f554c467e3a4dc49e2e578a755b4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3\",\"lessThan\":\"76b4d36c5122866452d34d8f79985e191f9c3831\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3\",\"lessThan\":\"5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3\",\"lessThan\":\"f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"031dcc8f4e84fea37dc6f78fdc7288aa7f8386c3\",\"lessThan\":\"d352873bbefa7eb39995239d0b44ccdf8aaa79a4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"security/apparmor/match.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.253\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.203\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.169\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.130\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.77\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.18\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.8\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.17.1\",\"versionEndExcluding\":\"5.10.253\",\"matchCriteriaId\":\"E395B1A0-3F3F-4299-9E96-FE513DCFE882\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.203\",\"matchCriteriaId\":\"20DDB3E9-AABF-4107-ADB0-5362AA067045\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.169\",\"matchCriteriaId\":\"DBEC0E5D-641C-4E98-A6D9-5799B10CE451\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.130\",\"matchCriteriaId\":\"C57BB918-DF28-46B3-94F7-144176841267\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.77\",\"matchCriteriaId\":\"B3D12E00-E42D-4056-B354-BAD4903C03A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.18\",\"matchCriteriaId\":\"346AD1FB-0CE8-4D9D-8E56-5EB1A4D06199\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.8\",\"matchCriteriaId\":\"C65A7D85-C7C6-485E-AC35-66A374C73FAC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:4.17:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F438846-FE97-43DC-A655-B5EF8DED552E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22094c996968a7c5b59cd3fc9fcbdfdd46d02fec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/555829fd91eaf0711e369b0a92aecb0f0aa3281f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/76b4d36c5122866452d34d8f79985e191f9c3831\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c7cf05e0606f554c467e3a4dc49e2e578a755b4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d352873bbefa7eb39995239d0b44ccdf8aaa79a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:20:47+00:00",
      "cve": "CVE-2026-23407",
      "id": "CVE-2026-23407",
      "initial_release_date": "2026-04-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: apparmor: fix missing bounds check on DEFAULT table in verify_dfa()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23407.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T05:28:52Z",
      "cve": "CVE-2026-23407",
      "id": "CVE-2026-23407",
      "initial_release_date": "2026-04-02T08:39:08Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "406",
      "product_status:known_not_affected": "518",
      "product_status:recommended": "460",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23407",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23407.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.