CVE-2026-23406
Out-of-Bounds Read in Linux AppArmor match_char() Macro
Publication date: 2026-04-01
Last updated on: 2026-04-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 4.17 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.2 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.77 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.169 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.18 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.8 (exc) |
| linux | linux_kernel | From 4.17.1 (inc) to 5.10.253 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's AppArmor component, specifically in the usage of the match_char() macro. The macro evaluates its character parameter multiple times when processing differential encoding chains. When called with *str++, the string pointer advances on each iteration of the inner loop, causing the system to check different characters each time and skip some input characters.
As a result, the pointer can advance beyond the input buffer boundary, leading to out-of-bounds reads. This means the kernel may read memory it should not access, which can cause crashes or other unintended behavior.
The fix involved changing the code to extract the character value before calling match_char, ensuring the character is evaluated only once per loop iteration.
How can this vulnerability impact me? :
This vulnerability can lead to out-of-bounds memory reads in the Linux kernel's AppArmor security module. Such out-of-bounds reads may cause system instability, crashes, or potentially expose sensitive kernel memory contents.
While the description does not explicitly mention privilege escalation or code execution, out-of-bounds reads in kernel space can be a serious security risk, potentially allowing attackers to gain unauthorized information or cause denial of service.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as out-of-bounds reads in the Linux kernel's AppArmor module, which can be detected by observing kernel logs for specific error messages.
Look for kernel messages indicating KASAN slab-out-of-bounds errors related to aa_dfa_match, such as:
- BUG: KASAN: slab-out-of-bounds in aa_dfa_match
- Read of size 1 at addr ... by task file/...
You can check the kernel logs using commands like:
- dmesg | grep -i 'KASAN: slab-out-of-bounds'
- journalctl -k | grep -i 'aa_dfa_match'
Monitoring these logs can help detect if the vulnerability is being triggered on your system.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to update the Linux kernel to a version where this vulnerability has been fixed.
The fix involves correcting the match_char() macro usage in the AppArmor module to prevent out-of-bounds reads.
Until the kernel is updated, consider monitoring kernel logs for signs of exploitation and limit exposure by restricting untrusted access to the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability in the Linux kernel's apparmor component results in out-of-bounds reads, which can lead to potential unauthorized access or corruption of memory. Given its impact on confidentiality, integrity, and availability (all rated high in the CVSS score), it could pose risks to systems handling sensitive data.
Such risks may affect compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information against unauthorized access and data breaches.
However, the provided information does not explicitly state the direct impact on compliance or specific regulatory requirements.