NVD Vulnerability Detail

CVE-2026-23407

Summary	In the Linux kernel, the following vulnerability has been resolved: apparmor: fix missing bounds check on DEFAULT table in verify_dfa() The verify_dfa() function only checks DEFAULT_TABLE bounds when the state is not differentially encoded. When the verification loop traverses the differential encoding chain, it reads k = DEFAULT_TABLE[j] and uses k as an array index without validation. A malformed DFA with DEFAULT_TABLE[j] >= state_count, therefore, causes both out-of-bounds reads and writes. [ 57.179855] ================================================================== [ 57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660 [ 57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993 [ 57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy) [ 57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 57.181563] Call Trace: [ 57.181572] <TASK> [ 57.181577] dump_stack_lvl+0x5e/0x80 [ 57.181596] print_report+0xc8/0x270 [ 57.181605] ? verify_dfa+0x59a/0x660 [ 57.181608] kasan_report+0x118/0x150 [ 57.181620] ? verify_dfa+0x59a/0x660 [ 57.181623] verify_dfa+0x59a/0x660 [ 57.181627] aa_dfa_unpack+0x1610/0x1740 [ 57.181629] ? __kmalloc_cache_noprof+0x1d0/0x470 [ 57.181640] unpack_pdb+0x86d/0x46b0 [ 57.181647] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181653] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181656] ? aa_unpack_nameX+0x1a8/0x300 [ 57.181659] aa_unpack+0x20b0/0x4c30 [ 57.181662] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181664] ? stack_depot_save_flags+0x33/0x700 [ 57.181681] ? kasan_save_track+0x4f/0x80 [ 57.181683] ? kasan_save_track+0x3e/0x80 [ 57.181686] ? __kasan_kmalloc+0x93/0xb0 [ 57.181688] ? __kvmalloc_node_noprof+0x44a/0x780 [ 57.181693] ? aa_simple_write_to_buffer+0x54/0x130 [ 57.181697] ? policy_update+0x154/0x330 [ 57.181704] aa_replace_profiles+0x15a/0x1dd0 [ 57.181707] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181710] ? __kvmalloc_node_noprof+0x44a/0x780 [ 57.181712] ? aa_loaddata_alloc+0x77/0x140 [ 57.181715] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181717] ? _copy_from_user+0x2a/0x70 [ 57.181730] policy_update+0x17a/0x330 [ 57.181733] profile_replace+0x153/0x1a0 [ 57.181735] ? rw_verify_area+0x93/0x2d0 [ 57.181740] vfs_write+0x235/0xab0 [ 57.181745] ksys_write+0xb0/0x170 [ 57.181748] do_syscall_64+0x8e/0x660 [ 57.181762] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.181765] RIP: 0033:0x7f6192792eb2 Remove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE entries unconditionally.
Publication Date	April 1, 2026, 6:16 p.m.
Registration Date	April 27, 2026, 12:21 p.m.
Last Update	April 25, 2026, 1:38 a.m.

CVSS3.1 : HIGH
スコア	7.8
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	低
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:linux:linux_kernel::::::::	4.17.1			5.10.253
cpe:2.3:o:linux:linux_kernel::::::::	5.11			5.15.203
cpe:2.3:o:linux:linux_kernel::::::::	5.16			6.1.169
cpe:2.3:o:linux:linux_kernel::::::::	6.2			6.6.130
cpe:2.3:o:linux:linux_kernel::::::::	6.7			6.12.77
cpe:2.3:o:linux:linux_kernel::::::::	6.13			6.18.18
cpe:2.3:o:linux:linux_kernel::::::::	6.19			6.19.8
cpe:2.3:o:linux:linux_kernel:4.17:-::::::
cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::
cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

Related information, measures and tools

No	URL	refsource
1	https://git.kernel.org/stable/c/22094c996968a7c5b59cd3fc9fcbdfdd46d02fec	416baaa9-dc9f-4396-8d5f-8c081fb06d67
2	https://git.kernel.org/stable/c/555829fd91eaf0711e369b0a92aecb0f0aa3281f	416baaa9-dc9f-4396-8d5f-8c081fb06d67
3	https://git.kernel.org/stable/c/5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc	416baaa9-dc9f-4396-8d5f-8c081fb06d67
4	https://git.kernel.org/stable/c/76b4d36c5122866452d34d8f79985e191f9c3831	416baaa9-dc9f-4396-8d5f-8c081fb06d67
5	https://git.kernel.org/stable/c/7c7cf05e0606f554c467e3a4dc49e2e578a755b4	416baaa9-dc9f-4396-8d5f-8c081fb06d67
6	https://git.kernel.org/stable/c/a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c	416baaa9-dc9f-4396-8d5f-8c081fb06d67
7	https://git.kernel.org/stable/c/d352873bbefa7eb39995239d0b44ccdf8aaa79a4	416baaa9-dc9f-4396-8d5f-8c081fb06d67
8	https://git.kernel.org/stable/c/f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed	416baaa9-dc9f-4396-8d5f-8c081fb06d67

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-125	境界外読み取り	https://cwe.mitre.org/data/definitions/125.html

JVN Vulnerability Information

LinuxのLinux Kernelにおける境界外読み取りに関する脆弱性

Title	LinuxのLinux Kernelにおける境界外読み取りに関する脆弱性
Summary	LinuxカーネルのAppArmorにおいて、verify_dfa()関数でDEFAULTテーブルの境界チェックが不十分であった問題を修正しました。この関数は差分エンコードが有効な場合にのみ境界チェックを実施しており、不正なDFAデータにより境界外の読み書きが発生する可能性がありました。本修正ではMATCH_FLAG_DIFF_ENCODE条件を削除し、すべてのDEFAULT_TABLEエントリを無条件に検証するようにしました。
Possible impacts	当該ソフトウェアが扱う全ての情報が外部に漏れる可能性があります。また、当該ソフトウェアが扱う全ての情報が書き換えられる可能性があります。さらに、当該ソフトウェアが完全に停止する可能性があります。そして、この脆弱性を悪用した攻撃の影響は、他のソフトウェアには及びません。
Solution	リリース情報、またはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。
Publication Date	April 1, 2026, midnight
Registration Date	April 27, 2026, 10:53 a.m.
Last Update	April 27, 2026, 10:53 a.m.

Affected System

Linux

Linux Kernel 4.17

Linux Kernel 4.17.1 以上 5.10.253 未満

Linux Kernel 5.11 以上 5.15.203 未満

Linux Kernel 5.16 以上 6.1.169 未満

Linux Kernel 6.13 以上 6.18.18 未満

Linux Kernel 6.19 以上 6.19.8 未満

Linux Kernel 6.2 以上 6.6.130 未満

Linux Kernel 6.7 以上 6.12.77 未満

Linux Kernel 7.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2026-23407	https://www.cve.org/CVERecord?id=CVE-2026-23407
National Vulnerability Database (NVD)
2	CVE-2026-23407	https://nvd.nist.gov/vuln/detail/CVE-2026-23407

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-125	https://cwe.mitre.org/data/definitions/125.html

その他

No	Name	URL
関連文書
1	apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/22094c996968a7c5b59cd3fc9fcbdfdd46d02fec)	https://git.kernel.org/stable/c/22094c996968a7c5b59cd3fc9fcbdfdd46d02fec
2	apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/555829fd91eaf0711e369b0a92aecb0f0aa3281f)	https://git.kernel.org/stable/c/555829fd91eaf0711e369b0a92aecb0f0aa3281f
3	apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc)	https://git.kernel.org/stable/c/5a68e46dfe0c8c8ffc6f425ebc4cae6238566ecc
4	apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/76b4d36c5122866452d34d8f79985e191f9c3831)	https://git.kernel.org/stable/c/76b4d36c5122866452d34d8f79985e191f9c3831
5	apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/7c7cf05e0606f554c467e3a4dc49e2e578a755b4)	https://git.kernel.org/stable/c/7c7cf05e0606f554c467e3a4dc49e2e578a755b4
6	apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c)	https://git.kernel.org/stable/c/a75e12ca90c9e70ba10fee1be2f63cdd63d91a7c
7	apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/d352873bbefa7eb39995239d0b44ccdf8aaa79a4)	https://git.kernel.org/stable/c/d352873bbefa7eb39995239d0b44ccdf8aaa79a4
8	apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed)	https://git.kernel.org/stable/c/f39e126e56c6ec1930fae51ad6bca3dae2a4c3ed

Change Log

No	Changed Details	Date of change
1	[2026年04月27日] 掲載	April 27, 2026, 10:53 a.m.