CVE-2026-23406: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23406 is an out-of-bounds read vulnerability in the Linux kernel's AppArmor security module, caused by a side-effect bug in the match_char() macro. The macro evaluates its character parameter multiple times when traversing differential encoding chains; when invoked with *str++, the string pointer advances on each iteration of the inner do-while loop, causing the DFA to skip input characters and eventually read past the input buffer boundary. The vulnerability was published on April 1, 2026, and affects Linux kernel versions 4.17 through multiple stable branches up to 6.19.7, as well as Microsoft Azure Linux 3 kernel 6.6.0.0-1. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-788 (Access of Memory Location After End of Buffer). The match_char() macro in the AppArmor DFA matching code (aa_dfa_match()) is a C preprocessor macro that expands its argument — including side effects like post-increment — at each point of use within the macro body. When called as match_char(*str++), the pointer str is incremented on every iteration of the inner do-while loop rather than once per outer loop iteration, causing the DFA to evaluate different characters than intended and skip bytes in the input string. This pointer overrun results in a slab-out-of-bounds read detectable via KASAN, triggered during normal file open operations that invoke AppArmor permission checks (apparmor_file_open → aa_path_perm → aa_dfa_match). The fix extracts the character value into a local variable before invoking match_char, ensuring single evaluation per outer loop iteration (GitHub Advisory, Red Hat Bugzilla).

A local attacker with low privileges can trigger out-of-bounds kernel memory reads by performing file operations on a system with AppArmor enabled, potentially disclosing sensitive kernel memory contents. The vulnerability also carries a risk of denial of service through memory access violations, and the high integrity and availability CVSS sub-scores indicate potential for further exploitation leading to system instability or integrity compromise. KASAN reports confirm slab-out-of-bounds reads are reachable during aa_dfa_match() execution in the context of file open syscalls (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges (e.g., a standard user account) and is triggered through ordinary file operations on AppArmor-enabled systems. The EPSS score is approximately 0.018% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

• Logs: Kernel logs containing KASAN reports with BUG: KASAN: slab-out-of-bounds in aa_dfa_match and stack traces referencing aa_dfa_match, __aa_path_perm, aa_path_perm, and apparmor_file_open.
• Logs: Kernel messages showing Read of size 1 at addr within slab memory regions, associated with a process performing file open operations.
• Process: Unusual or repeated file open (openat) syscalls from low-privilege processes that consistently trigger AppArmor permission checks and result in kernel warnings or crashes.

Upgrade to a patched Linux kernel version: 5.10.253+, 5.15.203+, 6.1.169+, 6.6.130+, 6.12.77+, 6.18.18+, or 6.19.8+, depending on the distribution's supported branch. Patches are available at git.kernel.org (commit IDs: 0510d1ba, 1fc94f16, 383b7270, 5a184f7c, 8756b68e, b73c1dff, c7dc56d8, f16f2e59). Microsoft Azure Linux 3 users should update the azl3_kernel package. Ubuntu security notices USN-8152-1, USN-8163-1, USN-8163-2, USN-8201-1, USN-8224-1, and USN-8243-1 address this issue; SUSE has released advisories SUSE-SU-2026:2111-1, SUSE-SU-2026:2195-1, SUSE-SU-2026:2215-1, and SUSE-SU-2026:2238-1. As a temporary measure, disabling AppArmor can prevent exploitation but significantly reduces system security posture (GitHub Advisory, Red Hat Bugzilla).

Qualys published a blog post titled "CrackArmor: Critical AppArmor Flaws Enable Local Privilege Escalation to Root" covering this and related AppArmor vulnerabilities, indicating notable security research attention on the AppArmor subsystem. Ubuntu, SUSE, and Microsoft have all issued vendor advisories addressing the vulnerability. The oss-security mailing list carried an early disclosure notice shortly after the CVE was published (Qualys Blog).