CVE Explorer

CVE-2026-23269

In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read. ================================================================== BUG: KASAN:

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:46cc982b15ef217f3a5302772d2ad5441916f20f9ef990b1d7de46ae33def862

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["security/apparmor/policy_unpack.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f43eea8ae0102ea198da211ef7f5ce83725ecf19","status":"affected","version":"ad5ff3db53c68c2f12936bc74ea5dfe0af943592","versionType":"git"},{"lessThan":"5487871b2b56c19d26936ed6fdc62652b30941df","status":"affected","version":"ad5ff3db53c68c2f12936bc74ea5dfe0af943592","versionType":"git"},{"lessThan":"5443c027ec16afa55b1b8a3e7a1ab2ea3c77767a","status":"affected","version":"ad5ff3db53c6…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["security/apparmor/policy_unpack.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.4"},{"lessThan":"3.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"}…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/affected/1

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/affected/0

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/metrics/0/cvssV3_1

Source references

9 source assertions

{"url":"https://git.kernel.org/stable/c/07cf6320f40ea2ccfad63728cff34ecb309d03da"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/0baadb0eece2c4d939db10d3c323b4652ac79a58"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/3bb7db43e32190c973d4019037cedb7895920184"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/references/6

{"url":"https://git.kernel.org/stable/c/5443c027ec16afa55b1b8a3e7a1ab2ea3c77767a"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/5487871b2b56c19d26936ed6fdc62652b30941df"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/9063d7e2615f4a7ab321de6b520e23d370e58816"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/references/7

{"url":"https://git.kernel.org/stable/c/f43eea8ae0102ea198da211ef7f5ce83725ecf19"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/references/0

{"url":"https://www.qualys.com/2026/03/10/crack-armor.txt"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:868cc4c9ad372025c78ed589c6b0ecdd1499da1ed58a248f119b02b426702240 · sha256:b1e31a88cb565d32… · /containers/cna/references/8

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer