Technical Summary

CVE-2026-23268 is a vulnerability in the Linux kernel's AppArmor Linux Security Module (LSM) that permits an unprivileged local attacker to load, replace, and remove AppArmor profiles by exploiting a confused deputy attack. The attacker opens the apparmorfs interface and passes the file descriptor to a privileged process, which then performs writes on the attacker's behalf. This requires a privileged target process that can be manipulated to write to the interface. Successful exploitation grants full policy management capabilities, enabling actions such as removing confinement, causing denial of service by denying execution, bypassing unprivileged user namespace restrictions, or exploiting kernel bugs for local privilege escalation. The vulnerability cannot be mitigated by simply changing file permissions due to legitimate non-root policy loading needs. Multiple versions of the linux-azure kernel are affected. Ubuntu has released patches addressing this issue in their linux-raspi and linux-oem kernel packages. The vulnerability has a CVSS v3.1 score of 7.8 (high severity).