CVE-2026-23407 in Linux
الملخص
بحسب VulDB • 03/06/2026
في نواة لينكس، تم حل الثغرة التالية:
apparmor: إصلاح فحص الحدود المفقود في جدول DEFAULT في verify_dfa()
تقوم دالة verify_dfa() بفحص حدود DEFAULT_TABLE فقط عندما لا تكون الحالة مشفرة تفاضلياً (differentially encoded).
عندما يمر حلقة التحقق عبر سلسلة التشفير التفاضلي، فإنها تقرأ k = DEFAULT_TABLE[j] وتستخدم k كمؤشر مصفوفة دون التحقق من صحته. وبالتالي، فإن آلة الحالات المنتهية المحددة (DFA) غير الصحيحة التي تحتوي على DEFAULT_TABLE[j] >= state_count، تسبب كل من القراءة والكتابة خارج الحدود (out-of-bounds).
[ 57.179855] ==================================================================
[ 57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660
[ 57.180904] Read of size 4 at addr ffff888100eadec4 by task su/999
[ 57.181133]
[ 57.181133] CPU: 1 PID: 999 Comm: su Not tainted 6.12.0-rc5+ #10
[ 57.181133] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc40 04/01/2014
[ 57.181133] Call Trace:
[ 57.181133] <TASK>
[ 57.181133] dump_stack_lvl+0x1e5/0x310
[ 57.181133] print_report+0xcf/0x610
[ 57.181133] kasan_report+0xc7/0x110
[ 57.181133] ? verify_dfa+0x59a/0x660
[ 57.181133] verify_dfa+0x59a/0x660
[ 57.181133] aa_unpack_nameX+0x1a8/0x300
[ 57.181133] aa_unpack+0x20b0/0x4c30
[ 57.181133] ? srso_alias_return_thunk+0x5/0xfbef5
[ 57.181133] ? stack_depot_save_flags+0x33/0x700
[ 57.181133] ? kasan_save_track+0x4f/0x80
[ 57.181133] ? kasan_save_track+0x3e/0x80
[ 57.181133] ? __kasan_kmalloc+0x93/0xb0
[ 57.181133] ? __kvmalloc_node_noprof+0x44a/0x780
[ 57.181133] ? aa_simple_write_to_buffer+0x54/0x130
[ 57.181133] ? policy_update+0x154/0x330
[ 57.181133] aa_replace_profiles+0x15a/0x1dd0
[ 57.181133] ? srso_alias_return_thunk+0x5/0xfbef5
[ 57.181133] ? __kvmalloc_node_noprof+0x44a/0x780
[ 57.181133] ? aa_loaddata_alloc+0x77/0x140
[ 57.181133] ? srso_alias_return_thunk+0x5/0xfbef5
[ 57.181133] ? _copy_from_user+0x2a/0x70
[ 57.181133] policy_update+0x17a/0x330
[ 57.181133] profile_replace+0x153/0x1a0
[ 57.181133] ? rw_verify_area+0x93/0x2d0
[ 57.181133] vfs_write+0x235/0xab0
[ 57.181133] ksys_write+0xb0/0x170
[ 57.181133] do_syscall_64+0x8e/0x660
[ 57.181133] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 57.181133
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.