CVE-2026-23407
Out-of-Bounds Read/Write in Linux AppArmor verify_dfa() Function
Publication date: 2026-04-01
Last updated on: 2026-04-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 4.17 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.2 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.77 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.169 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.18 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.8 (exc) |
| linux | linux_kernel | From 4.17.1 (inc) to 5.10.253 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's AppArmor component, specifically in the verify_dfa() function. The function fails to properly check the bounds of the DEFAULT_TABLE array when processing differentially encoded states. As a result, if a malformed DFA (Deterministic Finite Automaton) contains an out-of-bounds index in DEFAULT_TABLE, the function can perform out-of-bounds reads and writes, potentially leading to memory corruption.
How can this vulnerability impact me? :
The vulnerability can cause out-of-bounds memory access in the kernel, which may lead to system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges. This could compromise the security and reliability of the affected system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for specific error messages related to out-of-bounds accesses in the verify_dfa() function of AppArmor.
Look for kernel messages indicating KASAN (Kernel Address Sanitizer) slab-out-of-bounds errors involving verify_dfa, such as:
- BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660
- Read of size 4 at addr ... by task su/...
You can check the kernel logs using commands like:
- dmesg | grep -i verify_dfa
- journalctl -k | grep -i kasan
- journalctl -k | grep -i verify_dfa
These commands help identify if the kernel has logged any out-of-bounds errors related to this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Linux kernel to a version where this vulnerability has been fixed.
The fix involves removing the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE entries unconditionally, preventing out-of-bounds reads and writes in the verify_dfa() function.
Until the kernel is updated, monitoring for related kernel errors and avoiding loading or using malformed AppArmor profiles that could trigger this vulnerability is advisable.