CVE-2026-23268

HIGH EPSS 3.3%
Published Mar 18, 20263mo ago · Modified May 29, 20261mo ago
7.8 CVSS 3.1
High
Find Similar
Published Mar 18, 2026 3mo ago
Last Modified May 29, 2026 1mo ago

Description

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by passing the opened fd to a privileged process, and getting the privileged process to write to the interface. This does require a privileged target that can be manipulated to do the write for the unprivileged process, but once such access is achieved full policy management is possible and all the possible implications that implies: removing confinement, DoS of system or target applications by denying all execution, by-passing the unprivileged user namespace restriction, to exploiting kernel bugs for a local privilege escalation. The policy management interface can not have its permissions simply changed from 0666 to 0600 because non-root processes need to be able to load policy to different policy namespaces. Instead ensure the task writing the interface has privileges that are a subset of the task that opened the interface. This is already done via policy for confined processes, but unconfined can delegate access to the opened fd, by-passing the usual policy check.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
3.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 10

VendorProductVersionRange
linuxlinux_kernel*≥4.11  –  <5.10.253
linuxlinux_kernel*≥5.11  –  <5.15.203
linuxlinux_kernel*≥5.16  –  <6.1.169
linuxlinux_kernel*≥6.2  –  <6.6.130
linuxlinux_kernel*≥6.7  –  <6.12.77
linuxlinux_kernel*≥6.13  –  <6.18.18
linuxlinux_kernel*≥6.19  –  <6.19.8
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any

References 9

  • git.kernel.org https://git.kernel.org/stable/c/0fc63dd9170643d15c25681fca792539e23f4640
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/17debf5586020790b5717f96e5e6a3ca5bb961ab
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/33ee909702e047c94aaf41d4eea35626d509802c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4cafce4d6d0a66ec27e3af5637c11901d60189fa
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6601e13e82841879406bf9f369032656f441a425
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a407a078cd41b5261b99d822af784bd9f136eb4d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b60b3f7a35c46b2e0ca934f9c988b8fca06d76c6
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b6a94eeca9c6c8f7c55ad44c62c98324f51ec596
    Patch
  • qualys.com https://www.qualys.com/2026/03/10/crack-armor.txt
    Third Party Advisory

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/0fc63dd9170643d15c25681fca792539e23f4640
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/17debf5586020790b5717f96e5e6a3ca5bb961ab
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/33ee909702e047c94aaf41d4eea35626d509802c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4cafce4d6d0a66ec27e3af5637c11901d60189fa
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6601e13e82841879406bf9f369032656f441a425
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a407a078cd41b5261b99d822af784bd9f136eb4d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b60b3f7a35c46b2e0ca934f9c988b8fca06d76c6
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b6a94eeca9c6c8f7c55ad44c62c98324f51ec596
    Patch