In the Linux kernel, the following vulnerability has been resolved:
AppArmor: Allow apparmor to handle unaligned dfa tables
The dfa tables can originate from kernel or userspace and 8-byte alignment isn't always guaranteed and as such may trigger unaligned memory accesses on various architectures. Resulting in the following
[ 73.901376] WARNING: CPU: 0 PID: 341 at security/apparmor/match.c:316 aa_dfa_unpack+0x6cc/0x720 [ 74.015867] Modules linked in: binfmt_misc evdev flash sg drm drm_panel_orientation_quirks backlight i2c_core configfs nfnetlink autofs4 ext4 crc16 mbcache jbd2 hid_generic usbhid sr_mod hid cdrom sd_mod ata_generic ohci_pci ehci_pci ehci_hcd ohci_hcd pata_ali libata sym53c8xx scsi_transport_spi tg3 scsi_mod usbcore libphy scsi_common mdio_bus usb_common [ 74.428977] CPU: 0 UID: 0 PID: 341 Comm: apparmor_parser Not tainted 6.18.0-rc6+ #9 NONE [ 74.536543] Call Trace: [ 74.568561] [<0000000000434c24>] dump_stack+0x8/0x18 [ 74.633757] [<0000000000476438>] __warn+0xd8/0x100 [ 74.696664] [<00000000004296d4>] warn_slowpath_fmt+0x34/0x74 [ 74.771006] [<00000000008db28c>] aa_dfa_unpack+0x6cc/0x720 [ 74.843062] [<00000000008e643c>] unpack_pdb+0xbc/0x7e0 [ 74.910545] [<00000000008e7740>] unpack_profile+0xbe0/0x1300 [ 74.984888] [<00000000008e82e0>] aa_unpack+0xe0/0x6a0 [ 75.051226] [<00000000008e3ec4>] aa_replace_profiles+0x64/0x1160 [ 75.130144] [<00000000008d4d90>] policy_update+0xf0/0x280 [ 75.201057] [<00000000008d4fc8>] profile_replace+0xa8/0x100 [ 75.274258] [<0000000000766bd0>] vfs_write+0x90/0x420 [ 75.340594] [<00000000007670cc>] ksys_write+0x4c/0xe0 [ 75.406932] [<0000000000767174>] sys_write+0x14/0x40 [ 75.472126] [<0000000000406174>] linux_sparc_syscall+0x34/0x44 [ 75.548802] ---[ end trace 0000000000000000 ]--- [ 75.609503] dfa blob stream 0xfff0000008926b96 not aligned. [ 75.682695] Kernel unaligned access at TPC[8db2a8] aa_dfa_unpack+0x6e8/0x720
Work around it by using the get_unaligned_xx() helpers.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1060-awsUpgrade linux-image-6.8.0-1045-gkeopUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-azure-lts-24.04Upgrade linux-image-oem-20.04cUpgrade linux-image-virtualUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-134-lowlatencyUpgrade linux-image-xilinxUpgrade linux-image-6.8.1-1055-realtimeUpgrade linux-image-intel-iotgUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1058-nvidia-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-oem-22.04bUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.8.0-1060-aws-fipsUpgrade linux-image-aws-fips-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-gcpUpgrade linux-image-azure-fipsUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-136-genericUpgrade linux-image-azure-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-ibm-6.8Upgrade linux-image-aws-64k-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-nvidia-64kUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-lowlatencyUpgrade linux-image-oracle-6.8Upgrade linux-image-kvmUpgrade linux-image-6.8.0-1058-gkeUpgrade linux-image-6.8.0-1063-gcp-64kUpgrade linux-image-laptop-23.10Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-aws-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1062-azure-fipsUpgrade linux-image-6.8.0-1058-nvidiaUpgrade linux-image-aws-lts-24.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-20.04dUpgrade linux-image-ibmUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1063-gcp-fipsUpgrade linux-image-6.8.0-2049-raspi-realtimeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-64k-6.8Upgrade linux-image-awsUpgrade linux-image-azure-fips-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-6.8.0-1029-nvidia-tegra-rtUpgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1063-azureUpgrade linux-image-6.8.0-1060-raspiUpgrade linux-image-6.8.0-1058-nvidia-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-genericUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oem-20.04Upgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-1032-xilinxUpgrade linux-image-raspiUpgrade linux-image-raspi-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-nvidia-tegraUpgrade linux-image-6.8.0-1057-oracleUpgrade linux-image-oem-20.04bUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1060-aws-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-gcp-64kUpgrade linux-image-aws-fipsUpgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-136-generic-64kUpgrade linux-image-6.8.0-134-genericUpgrade linux-image-6.8.0-1058-nvidia-lowlatencyUpgrade linux-image-virtual-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-134-fipsUpgrade linux-image-6.8.0-1060-ibmUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1057-oracle-64kUpgrade linux-image-6.8.0-1062-azure-fdeUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-134-generic-64kUpgrade linux-image-azureUpgrade linux-image-6.8.0-1063-gcpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-realtimeUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-nvidiaUpgrade linux-image-gke-64kUpgrade linux-image-fipsUpgrade linux-image-6.8.0-134-lowlatency-64kUpgrade linux-image-gcp-fipsUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1058-gke-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-xilinx-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-azure-fde-6.8Upgrade linux-image-6.8.0-1029-nvidia-tegraUpgrade linux-image-generic-lpaeUpgrade linux-image-gkeopUpgrade linux-image-gke | Jul 2, 2026 | Jul 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub