CVE-2026-46055 Linux CVE debrief

Who should care

Linux kernel maintainers, Ubuntu/Debian security teams, ARM64 server administrators, organizations using AppArmor for mandatory access control, snapd deployment operators, and security teams monitoring kernel memory safety issues

Technical summary

The vulnerability is a slab-out-of-bounds read in the Linux kernel's AppArmor security module, occurring in `aa_dfa_match()` at `security/apparmor/match.c:535`. The root cause is a missing string termination check when matching mount paths against AppArmor policy rules. The DFA matching logic reads beyond allocated buffer boundaries when processing strings that lack proper null termination. The issue manifests during `snap-update-ns` operations on ARM64 systems, with KASAN detecting a 1-byte read past an 8192-byte kmalloc-rnd-06-8k cache object. The vulnerability is triggered through the mount system call path: `__arm64_sys_mount` → `path_mount` → `security_sb_mount` → `apparmor_sb_mount` → `aa_bind_mount` → `match_mnt` → `match_mnt_path_str` → `aa_dfa_match`. The fix ensures proper string termination before invoking DFA matching operations.

Defensive priority

high

Recommended defensive actions

• Apply kernel patches from stable branches once available; monitor git.kernel.org stable commits for backports
• Enable KASAN in test environments to detect similar memory safety issues in AppArmor policy enforcement
• Review AppArmor mount mediation policies for systems processing untrusted mount requests
• Prioritize patching on ARM64 systems running Ubuntu 26.04 or Linux 7.0-rc4 with snapd/AppArmor enabled
• Validate kernel builds include the termination fix in aa_dfa_match before production deployment

Evidence notes

KASAN slab-out-of-bounds report confirms 1-byte read past 8192-byte buffer boundary at ffff0008901cc000. Call trace shows vulnerability path: `aa_bind_mount` → `match_mnt` → `match_mnt_path_str` → `aa_dfa_match`. Buffer allocated via `aa_get_buffer()` in `security/apparmor/lsm.c:2201`. Affects ARM64 platform specifically noted in reproduction environment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.