CVE-2026-46254
Received Received - Intake
AppArmor Unaligned DFA Table Access Handling

Publication date: 2026-06-03

Last updated on: 2026-06-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: AppArmor: Allow apparmor to handle unaligned dfa tables The dfa tables can originate from kernel or userspace and 8-byte alignment isn't always guaranteed and as such may trigger unaligned memory accesses on various architectures. Resulting in the following [   73.901376] WARNING: CPU: 0 PID: 341 at security/apparmor/match.c:316 aa_dfa_unpack+0x6cc/0x720 [   74.015867] Modules linked in: binfmt_misc evdev flash sg drm drm_panel_orientation_quirks backlight i2c_core configfs nfnetlink autofs4 ext4 crc16 mbcache jbd2 hid_generic usbhid sr_mod hid cdrom sd_mod ata_generic ohci_pci ehci_pci ehci_hcd ohci_hcd pata_ali libata sym53c8xx scsi_transport_spi tg3 scsi_mod usbcore libphy scsi_common mdio_bus usb_common [   74.428977] CPU: 0 UID: 0 PID: 341 Comm: apparmor_parser Not tainted 6.18.0-rc6+ #9 NONE [   74.536543] Call Trace: [   74.568561] [<0000000000434c24>] dump_stack+0x8/0x18 [   74.633757] [<0000000000476438>] __warn+0xd8/0x100 [   74.696664] [<00000000004296d4>] warn_slowpath_fmt+0x34/0x74 [   74.771006] [<00000000008db28c>] aa_dfa_unpack+0x6cc/0x720 [   74.843062] [<00000000008e643c>] unpack_pdb+0xbc/0x7e0 [   74.910545] [<00000000008e7740>] unpack_profile+0xbe0/0x1300 [   74.984888] [<00000000008e82e0>] aa_unpack+0xe0/0x6a0 [   75.051226] [<00000000008e3ec4>] aa_replace_profiles+0x64/0x1160 [   75.130144] [<00000000008d4d90>] policy_update+0xf0/0x280 [   75.201057] [<00000000008d4fc8>] profile_replace+0xa8/0x100 [   75.274258] [<0000000000766bd0>] vfs_write+0x90/0x420 [   75.340594] [<00000000007670cc>] ksys_write+0x4c/0xe0 [   75.406932] [<0000000000767174>] sys_write+0x14/0x40 [   75.472126] [<0000000000406174>] linux_sparc_syscall+0x34/0x44 [   75.548802] ---[ end trace 0000000000000000 ]--- [   75.609503] dfa blob stream 0xfff0000008926b96 not aligned. [   75.682695] Kernel unaligned access at TPC[8db2a8] aa_dfa_unpack+0x6e8/0x720 Work around it by using the get_unaligned_xx() helpers.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-03
Last Modified
2026-06-03
Generated
2026-06-04
AI Q&A
2026-06-03
EPSS Evaluated
N/A
NVD
CVE-2026-46254
EUVD
EUVD-2026-34116
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
canonical linux_kernel 6.18.0-rc6+
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's AppArmor security module. It occurs because the deterministic finite automaton (dfa) tables used by AppArmor may not always be aligned on 8-byte boundaries, which is required on some architectures. Unaligned memory accesses can cause warnings or errors in the kernel, potentially leading to instability or crashes. The issue arises when AppArmor tries to handle these unaligned dfa tables, which can originate from either kernel space or userspace.

The vulnerability is addressed by modifying the code to use helper functions that safely handle unaligned memory accesses.


How can this vulnerability impact me? :

This vulnerability can lead to kernel warnings and potentially cause instability or crashes in systems using AppArmor on affected Linux kernel versions. Unaligned memory accesses may trigger CPU exceptions or unexpected behavior, which could disrupt normal system operations.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by monitoring the system kernel logs for specific warning messages related to AppArmor and unaligned dfa tables.

  • Check the kernel log for warnings similar to: "WARNING: CPU: ... at security/apparmor/match.c:316 aa_dfa_unpack".
  • Look for messages indicating unaligned access such as: "dfa blob stream ... not aligned." or "Kernel unaligned access at TPC... aa_dfa_unpack".
  • Use the command: dmesg | grep -i apparmor to filter relevant kernel messages.
  • Alternatively, use journalctl -k | grep -i apparmor to check systemd journal logs for these warnings.

What immediate steps should I take to mitigate this vulnerability?

The vulnerability is resolved by modifying the AppArmor code to handle unaligned dfa tables properly using get_unaligned_xx() helper functions.

Immediate mitigation steps include updating the Linux kernel to a version that contains this fix.

Until the kernel is updated, monitor for the warning messages and consider limiting the use of AppArmor profiles that trigger this issue.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart