Summary
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,
CVE-2026-23404, CVE-2026-23405, CVE-2026-23410, CVE-2026-23411)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Network drivers;
- Sun RPC protocol;
- XFRM subsystem;
(CVE-2024-27388, CVE-2024-46816, CVE-2024-49938, CVE-2024-50008,
CVE-2024-50142, CVE-2026-23209)
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws-hwe | 4.15.0-1191.204~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-gcp | 4.15.0-1184.201~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-hwe | 4.15.0-249.261~16.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux | 4.15.0-249.261 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws | 4.15.0-1191.204 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-azure-4.15 | 4.15.0-1200.215 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gcp-4.15 | 4.15.0-1184.201 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-kvm | 4.15.0-1173.178 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-oracle | 4.15.0-1153.164 |
| Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS | linux-aws-fips | 4.15.0-2129.135 |
| Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS | linux-fips | 4.15.0-1146.158 |
| Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS | linux-gcp-fips | 4.15.0-2092.98 |
Vulnerabilities 13
-
Critical 9.8
SUNRPC: fix some memleaks in gssx_dec_option_array
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssx_dec_option_array The creds and oa->data need to be freed in the error-handling paths after their allocation. So this patch add these deallocations in the cor…
-
High 7.8
drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links [Why] Coverity report OVERRUN warning. There are only max_links elements within dc->links. link count could up…
-
High 7.8
macvlan: fix error recovery in macvlan_common_newlink()
In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlan_common_newlink() valis provided a nice repro to crash the kernel: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link …
-
High 7.8
apparmor: fix unprivileged local user can do privileged policy management
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confuse…
-
High 7.8
apparmor: fix race on rawdata dereference
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata dereference There is a race condition that leads to a use-after-free situation: because the rawdata inodes are not refcounted, an attacker can start open()ing on…
-
High 7.8
apparmor: fix race between freeing data and fs accessing it
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the…
-
High 7.1
apparmor: validate DFA start states are in bounds in unpack_pdb
In the Linux kernel, the following vulnerability has been resolved: apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unp…
-
Medium 5.5
xfrm: validate new SA's prefixlen using SA family when sel.family is unset
In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm se…
-
Unscored —
wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in…
-
Unscored —
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() Replace one-element array with a flexible-array member in `struct host_cmd_ds_802_11_scan_ext`. With …
-
Unscored —
apparmor: fix memory leak in verify_header
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix memory leak in verify_header The function sets `*ns = NULL` on every call, leaking the namespace string allocated in previous iterations when multiple profiles are unpacked. Thi…
-
Unscored —
apparmor: replace recursive profile removal with iterative approach
In the Linux kernel, the following vulnerability has been resolved: apparmor: replace recursive profile removal with iterative approach The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system…
-
Unscored —
apparmor: fix: limit the number of levels of policy namespaces
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix: limit the number of levels of policy namespaces Currently the number of policy namespaces is not bounded relying on the user namespace limit. However policy namespaces aren't s…
References
-
report
https://ubuntu.com/security/CVE-2024-27388
-
report
https://ubuntu.com/security/CVE-2024-46816
-
report
https://ubuntu.com/security/CVE-2024-49938
-
report
https://ubuntu.com/security/CVE-2024-50008
-
report
https://ubuntu.com/security/CVE-2024-50142
-
report
https://ubuntu.com/security/CVE-2026-23209
-
report
https://ubuntu.com/security/CVE-2026-23268
-
report
https://ubuntu.com/security/CVE-2026-23269
-
report
https://ubuntu.com/security/CVE-2026-23403
-
report
https://ubuntu.com/security/CVE-2026-23404
-
report
https://ubuntu.com/security/CVE-2026-23405
-
report
https://ubuntu.com/security/CVE-2026-23410
-
report
https://ubuntu.com/security/CVE-2026-23411
-
report
https://launchpad.net/bugs/2143853