Summary
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,
CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Cryptographic API;
- GPU drivers;
- I2C subsystem;
- BTRFS file system;
- XFRM subsystem;
- Padata parallel execution mechanism;
- IPv4 networking;
- IPv6 networking;
- MAC80211 subsystem;
- Netfilter;
- Network traffic control;
- SMC sockets;
(CVE-2021-47599, CVE-2022-48875, CVE-2022-49046, CVE-2022-49698,
CVE-2024-46816, CVE-2024-49927, CVE-2024-56640, CVE-2025-21726,
CVE-2025-21780, CVE-2025-37849, CVE-2025-40019, CVE-2025-40215,
CVE-2026-23060, CVE-2026-23074)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-bluefield | 5.4.0-1116.123 |
Vulnerabilities 24
-
Critical 9.8
net/smc: fix LGR and link use-after-free issue
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix LGR and link use-after-free issue We encountered a LGR/link use-after-free issue, which manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making …
-
High 8.8
KVM: arm64: Tear down vGIC on failed vCPU creation
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU…
-
High 7.8
drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links [Why] Coverity report OVERRUN warning. There are only max_links elements within dc->links. link count could up…
-
High 7.8
padata: avoid UAF for reorder_work
In the Linux kernel, the following vulnerability has been resolved: padata: avoid UAF for reorder_work Although the previous patch can avoid ps and ps UAF for _do_serial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as bel…
-
High 7.8
drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in f…
-
High 7.8
xfrm: delete x->tunnel as we delete x
In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (…
-
High 7.8
net/sched: Enforce that teql can only be used as root qdisc
In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not impo…
-
High 7.8
apparmor: fix unprivileged local user can do privileged policy management
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confuse…
-
High 7.8
apparmor: fix side-effect bug in match_char() macro usage
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix side-effect bug in match_char() macro usage The match_char() macro evaluates its character parameter multiple times when traversing differential encoding chains. When invoked wi…
-
High 7.8
apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix missing bounds check on DEFAULT table in verify_dfa() The verify_dfa() function only checks DEFAULT_TABLE bounds when the state is not differentially encoded. When the verificat…
-
High 7.8
apparmor: fix race on rawdata dereference
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata dereference There is a race condition that leads to a use-after-free situation: because the rawdata inodes are not refcounted, an attacker can start open()ing on…
-
High 7.8
apparmor: fix race between freeing data and fs accessing it
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the…
-
High 7.1
apparmor: validate DFA start states are in bounds in unpack_pdb
In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unp…
-
Unscored —
btrfs: use latest_dev in btrfs_show_devname
In the Linux kernel, the following vulnerability has been resolved: btrfs: use latest_dev in btrfs_show_devname The test case btrfs/238 reports the warning below: WARNING: CPU: 3 PID: 481 at fs/btrfs/super.c:2509 btrfs_show_devname+0x104/0x1e8 [btrfs] CPU: 2 …
-
Unscored —
wifi: mac80211: sdata can be NULL during AMPDU start
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: sdata can be NULL during AMPDU start ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a deauthentication is ongoing. Here a trace triggering the race with th…
-
Unscored —
i2c: dev: check return value when calling dev_set_name()
In the Linux kernel, the following vulnerability has been resolved: i2c: dev: check return value when calling dev_set_name() If dev_set_name() fails, the dev_name() is null, check the return value of dev_set_name() to avoid the null-ptr-deref.
-
Unscored —
netfilter: use get_random_u32 instead of prandom
In the Linux kernel, the following vulnerability has been resolved: netfilter: use get_random_u32 instead of prandom bh might occur while updating per-cpu rnd_state from user context, ie. local_out path. BUG: using smp_processor_id() in preemptible [00000000]…
-
Unscored —
x86/ioapic: Handle allocation failures gracefully
In the Linux kernel, the following vulnerability has been resolved: x86/ioapic: Handle allocation failures gracefully Breno observed panics when using failslab under certain conditions during runtime: can not alloc irq_pin_list (-1,0,20) Kernel panic - not sy…
-
Unscored —CVE-2025-40019 Public exploit
crypto: essiv - Check ssize for decryption and in-place encryption
In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.
-
Unscored —
crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than the minimum expected length, crypto_aut…
-
Unscored —
apparmor: fix memory leak in verify_header
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix memory leak in verify_header The function sets `*ns = NULL` on every call, leaking the namespace string allocated in previous iterations when multiple profiles are unpacked. Thi…
-
Unscored —
apparmor: replace recursive profile removal with iterative approach
In the Linux kernel, the following vulnerability has been resolved: apparmor: replace recursive profile removal with iterative approach The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system…
-
Unscored —
apparmor: fix: limit the number of levels of policy namespaces
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix: limit the number of levels of policy namespaces Currently the number of policy namespaces is not bounded relying on the user namespace limit. However policy namespaces aren't s…
-
Unscored —
apparmor: fix differential encoding verification
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix differential encoding verification Differential encoding allows loops to be created if it is abused. To prevent this the unpack should verify that a diff-encode chain terminates…
References
-
report
https://ubuntu.com/security/CVE-2021-47599
-
report
https://ubuntu.com/security/CVE-2022-48875
-
report
https://ubuntu.com/security/CVE-2022-49046
-
report
https://ubuntu.com/security/CVE-2022-49698
-
report
https://ubuntu.com/security/CVE-2024-46816
-
report
https://ubuntu.com/security/CVE-2024-49927
-
report
https://ubuntu.com/security/CVE-2024-56640
-
report
https://ubuntu.com/security/CVE-2025-21726
-
report
https://ubuntu.com/security/CVE-2025-21780
-
report
https://ubuntu.com/security/CVE-2025-37849
-
report
https://ubuntu.com/security/CVE-2025-40019
-
report
https://ubuntu.com/security/CVE-2025-40215
-
report
https://ubuntu.com/security/CVE-2026-23060
-
report
https://ubuntu.com/security/CVE-2026-23074
-
report
https://ubuntu.com/security/CVE-2026-23268
-
report
https://ubuntu.com/security/CVE-2026-23269
-
report
https://ubuntu.com/security/CVE-2026-23403
-
report
https://ubuntu.com/security/CVE-2026-23404
-
report
https://ubuntu.com/security/CVE-2026-23405
-
report
https://ubuntu.com/security/CVE-2026-23406
-
report
https://ubuntu.com/security/CVE-2026-23407
-
report
https://ubuntu.com/security/CVE-2026-23409
-
report
https://ubuntu.com/security/CVE-2026-23410
-
report
https://ubuntu.com/security/CVE-2026-23411
-
report
https://launchpad.net/bugs/2143853