CVE-2026-23268

Description

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by passing the opened fd to a privileged process, and getting the privileged process to write to the interface. This does require a privileged target that can be manipulated to do the write for the unprivileged process, but once such access is achieved full policy management is possible and all the possible implications that implies: removing confinement, DoS of system or target applications by denying all execution, by-passing the unprivileged user namespace restriction, to exploiting kernel bugs for a local privilege escalation. The policy management interface can not have its permissions simply changed from 0666 to 0600 because non-root processes need to be able to load policy to different policy namespaces. Instead ensure the task writing the interface has privileges that are a subset of the task that opened the interface. This is already done via policy for confined processes, but unconfined can delegate access to the opened fd, by-passing the usual policy check.

PUBLISHED Reserved 2026-01-13 | Published 2026-03-18 | Updated 2026-04-18 | Assigner Linux

Product status

References

git.kernel.org/...c/a407a078cd41b5261b99d822af784bd9f136eb4d

git.kernel.org/...c/4cafce4d6d0a66ec27e3af5637c11901d60189fa

git.kernel.org/...c/33ee909702e047c94aaf41d4eea35626d509802c

git.kernel.org/...c/17debf5586020790b5717f96e5e6a3ca5bb961ab

git.kernel.org/...c/0fc63dd9170643d15c25681fca792539e23f4640

git.kernel.org/...c/b60b3f7a35c46b2e0ca934f9c988b8fca06d76c6

git.kernel.org/...c/b6a94eeca9c6c8f7c55ad44c62c98324f51ec596

git.kernel.org/...c/6601e13e82841879406bf9f369032656f441a425

www.qualys.com/2026/03/10/crack-armor.txt

cve.org (CVE-2026-23268)

nvd.nist.gov (CVE-2026-23268)

Download JSON