Linux Kernel Vulnerability in AppArmor Macro Usage

CVE-2026-23406

What is CVE-2026-23406?

A vulnerability exists in the Linux kernel related to the AppArmor framework, specifically affecting the match_char() macro. This flaw arises when the macro evaluates its character parameter multiple times during the traversal of differential encoding chains. When used with an advancing pointer within a loop, it can lead to checking different characters with each iteration, which results in skipping input characters and ultimately leads to out-of-bounds reads. The fix involves extracting the character value prior to executing match_char, ensuring only a single evaluation per outer loop iteration.

References