In the Linux kernel, the following vulnerability has been resolved:
apparmor: validate DFA start states are in bounds in unpack_pdb
Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read.
================================================================== BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360 Read of size 4 at addr ffff88811956fb90 by task su/1097 ...
Reject policies with out-of-bounds start states during unpacking to prevent the issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Mar 20, 2026 | Mar 20, 2026 |
| Ubuntu | — | Upgrade linux-image-azure-cvmUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-4.15.0-1173-kvmUpgrade linux-image-4.15.0-1184-gcpUpgrade linux-image-4.15.0-1146-fipsUpgrade linux-image-aws-fipsUpgrade linux-image-xilinx-6.8Upgrade linux-image-4.15.0-1153-oracleUpgrade linux-image-aws-fips-4.15Upgrade linux-image-gcp-fipsUpgrade linux-image-oem-6.17Upgrade linux-image-oem-24.04cUpgrade linux-image-raspi-nolpaeUpgrade linux-image-raspi-5.4Upgrade linux-image-gcp-fips-4.15Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-kvmUpgrade linux-image-lowlatencyUpgrade linux-image-4.15.0-249-genericUpgrade linux-image-5.15.0-1109-azureUpgrade linux-image-4.15.0-2129-aws-fipsUpgrade linux-image-bluefield-5.4Upgrade linux-image-5.4.0-1161-azureUpgrade linux-image-azureUpgrade linux-image-4.15.0-1200-azureUpgrade linux-image-azure-5.4Upgrade linux-image-5.4.0-1139-raspiUpgrade linux-image-fipsUpgrade linux-image-aws-4.15Upgrade linux-image-aws-hweUpgrade linux-image-6.17.0-1017-oemUpgrade linux-image-azure-fipsUpgrade linux-image-raspiUpgrade linux-image-azure-5.15Upgrade linux-image-genericUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-oracle-4.15Upgrade linux-image-5.15.0-1109-azure-fipsUpgrade linux-image-azure-fips-5.15Upgrade linux-image-5.15.0-1096-intel-iot-realtimeUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-azure-4.15Upgrade linux-image-oracleUpgrade linux-image-bluefieldUpgrade linux-image-azure-lts-22.04Upgrade linux-image-xilinxUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-oem-24.04Upgrade linux-image-oemUpgrade linux-image-gcp-4.15Upgrade linux-image-6.8.0-1052-azure-fipsUpgrade linux-image-raspi-5.15Upgrade linux-image-virtual-hwe-16.04Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-aws-lts-18.04Upgrade linux-image-oem-24.04aUpgrade linux-image-gkeUpgrade linux-image-azure-fips-4.15Upgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-5.4.0-1116-bluefieldUpgrade linux-image-oem-24.04dUpgrade linux-image-gcpUpgrade linux-image-azure-lts-18.04Upgrade linux-image-oem-24.04bUpgrade linux-image-azure-fips-6.8Upgrade linux-image-virtualUpgrade linux-image-raspi2Upgrade linux-image-4.15.0-2092-gcp-fipsUpgrade linux-image-4.15.0-249-lowlatencyUpgrade linux-image-5.15.0-1110-azureUpgrade linux-image-4.15.0-2109-azure-fipsUpgrade linux-image-5.15.0-1097-raspiUpgrade linux-image-4.15.0-1191-aws | Mar 30, 2026 | Mar 18, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 18, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub