Improper Access Control in Linux kernel - CVE-2026-23268

Detailed vulnerability description

The vulnerability allows a local user to escalate privileges, modify AppArmor security policies, and cause a denial of service.

The vulnerability exists due to improper access control in the AppArmor policy management interface when handling file descriptor operations. A local user can open the apparmorfs interface and pass the file descriptor to a privileged process, tricking it into performing privileged policy management operations on behalf of the user.

The user must have access to a privileged process that can be manipulated to write to the AppArmor interface. Once exploited, the user can load, replace, or remove AppArmor profiles, leading to removal of confinement, denial of service by blocking application execution, bypassing user namespace restrictions, and potentially enabling local privilege escalation via kernel exploits.

How to mitigate CVE-2026-23268

Sources

• https://git.kernel.org/stable/c/0fc63dd9170643d15c25681fca792539e23f4640
• https://git.kernel.org/stable/c/6601e13e82841879406bf9f369032656f441a425
• https://git.kernel.org/stable/c/b60b3f7a35c46b2e0ca934f9c988b8fca06d76c6
• https://git.kernel.org/stable/c/b6a94eeca9c6c8f7c55ad44c62c98324f51ec596