Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-23269 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-23269 is an out-of-bounds read vulnerability in the Linux kernel's AppArmor subsystem, specifically within the unpack_pdb function. Start states parsed from untrusted policy data are used as indexes into DFA state tables without bounds validation, leading to an out-of-bounds read in aa_dfa_next when the start state exceeds the number of states in the DFA. This issue was detected via KASAN as a slab-out-of-bounds read of size 4.
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation results in high confidentiality and availability impacts, such as information disclosure through memory reads or denial of service via kernel crashes, but without integrity impact.
The provided kernel patch references detail the mitigation, which rejects AppArmor policies containing out-of-bounds start states during the unpacking process to prevent the invalid indexing. These fixes are available in stable kernel commits, including 07cf6320f40ea2ccfad63728cff34ecb309d03da, 0baadb0eece2c4d939db10d3c323b4652ac79a58, 15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c, 3bb7db43e32190c973d4019037cedb7895920184, and 5443c027ec16afa55b1b8a3e7a1ab2ea3c77767a.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12912
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call…
more
in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read. ================================================================== BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360 Read of size 4 at addr ffff88811956fb90 by task su/1097 ... Reject policies with out-of-bounds start states during unpacking to prevent the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation directly finds out-of-bounds read flaws through static analysis, fuzzing, and dynamic bounds checks.
Secure engineering principles require bounds checking and memory-safe constructs that stop out-of-bounds reads from being introduced.
Process isolation confines the effects of an out-of-bounds read to the compromised process.
Input validation rejects malformed indices or lengths that would otherwise cause reads outside buffer bounds.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices such as bounds checking and memory-safe languages directly prevent out-of-bounds reads.
Vulnerability scanning and recording can discover instances of out-of-bounds reads after code is deployed.
Routine patching replaces vulnerable code containing out-of-bounds read flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance includes fuzzing and static analysis that detect out-of-bounds read defects before release.
Secure coding standards explicitly forbid unsafe pointer arithmetic and mandate bounds-checked reads, eliminating CWE-125.