CVE-2026-23268 apparmor: fix unprivileged local user can do privileged policy management
Unprivileged local users can escalate privileges or bypass security controls by manipulating privileged processes to modify AppArmor policies via a confused deputy attack.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23268?
CVE-2026-23268 is a high-severity vulnerability in Linux kernel, published on 18 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix unprivileged local user can do privileged policy management
An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by passing the opened fd to a privileged process, and getting the privileged process to write to the interface.
This does require a privileged target that can be manipulated to do the write for the unprivileged process, but once such access is achieved full policy management is possible and all the possible implications that implies: removing confinement, DoS of system or target applications by denying all execution, by-passing the unprivileged user namespace restriction, to exploiting kernel bugs for a local privilege escalation.
The policy management interface can not have its permissions simply changed from 0666 to 0600 because non-root processes need to be able to load policy to different policy namespaces.
Instead ensure the task writing the interface has privileges that are a subset of the task that opened the interface. This is already done via policy for confined processes, but unconfined can delegate access to the opened fd, by-passing the usual policy check.
Which versions are affected by CVE-2026-23268?
It affects 1 product.
Linux distribution packages (11)
kernel-livepatch-SLE15-SP6_Update_18 SUSE:Linux Enterprise Live Patching 15 SP6 | All versions | 4-150600.2.1 |
kernel-livepatch-SLE15-SP6_Update_20 SUSE:Linux Enterprise Live Patching 15 SP6 | All versions | 3-150600.2.1 |
kernel-livepatch-SLE15-SP7-RT_Update_7 SUSE:Linux Enterprise Live Patching 15 SP7 | All versions | 4-150700.2.1 |
kernel-livepatch-SLE15-SP7-RT_Update_9 SUSE:Linux Enterprise Live Patching 15 SP7 | All versions | 3-150700.2.1 |
kernel-livepatch-SLE15-SP7_Update_8 SUSE:Linux Enterprise Live Patching 15 SP7 | All versions | 4-150700.2.1 |
kernel-livepatch-SLE16-RT_Update_3 SUSE:Linux Micro 6.2 | All versions | 4-160000.1.1 |
kernel-livepatch-SLE16-RT_Update_4 SUSE:Linux Micro 6.2 | All versions | 4-160000.1.1 |
kernel-livepatch-SLE16-RT_Update_5 SUSE:Linux Micro 6.2 | All versions | 3-160000.1.1 |
kernel-livepatch-SLE16-RT_Update_6 SUSE:Linux Micro 6.2 | All versions | 2-160000.1.1 |
kernel-livepatch-SLE16_Update_3 SUSE:Linux Micro 6.2 | All versions | 5-160000.1.1 |
kernel-livepatch-SLE16_Update_6 SUSE:Linux Micro 6.2 | All versions | 2-160000.1.1 |
Products include Linux kernel.
How do I fix CVE-2026-23268?
Apply the vendor's patch.
Is CVE-2026-23268 being exploited?
There is no known exploitation of CVE-2026-23268 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-80094, BELL-CVE-2026-23268, DEBIAN-CVE-2026-23268, GHSA-8qv8-8mpp-cc7j, SUSE-SU-2026:1444-1, SUSE-SU-2026:1454-1 and 26 more.