CVE-2026-23268

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix unprivileged local user can do privileged policy management

An unprivileged local user can load, replace, and remove profiles by

opening the apparmorfs interfaces, via a confused deputy attack, by

passing the opened fd to a privileged process, and getting the

privileged process to write to the interface.

This does require a privileged target that can be manipulated to do

the write for the unprivileged process, but once such access is

achieved full policy management is possible and all the possible

implications that implies: removing confinement, DoS of system or

target applications by denying all execution, by-passing the

unprivileged user namespace restriction, to exploiting kernel bugs for

a local privilege escalation.

The policy management interface can not have its permissions simply

changed from 0666 to 0600 because non-root processes need to be able

to load policy to different policy namespaces.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References