{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-23268",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-23268",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-03-18T17:54:41.974Z",
    "updatedAt": "2026-08-05T12:20:58.461Z",
    "importedAt": "2026-10-24T01:58:02.025Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "apparmor: fix unprivileged local user can do privileged policy management",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix unprivileged local user can do privileged policy management\n\nAn unprivileged local user can load, replace, and remove profiles by\nopening the apparmorfs interfaces, via a confused deputy attack, by\npassing the opened fd to a privileged process, and getting the\nprivileged process to write to the interface.\n\nThis does require a privileged target that can be manipulated to do\nthe write for the unprivileged process, but once such access is\nachieved full policy management is possible and all the possible\nimplications that implies: removing confinement, DoS of system or\ntarget applications by denying all execution, by-passing the\nunprivileged user namespace restriction, to exploiting kernel bugs for\na local privilege escalation.\n\nThe policy management interface can not have its permissions simply\nchanged from 0666 to 0600 because non-root processes need to be able\nto load policy to different policy namespaces.\n\nInstead ensure the task writing the interface has privileges that\nare a subset of the task that opened the interface. This is already\ndone via policy for confined processes, but unconfined can delegate\naccess to the opened fd, by-passing the usual policy check.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "b7fd2c0340eacbee892425e9007647568b7f2a3c",
              "status": "affected",
              "versionType": "git",
              "lessThan": "a407a078cd41b5261b99d822af784bd9f136eb4d"
            },
            {
              "version": "b7fd2c0340eacbee892425e9007647568b7f2a3c",
              "status": "affected",
              "versionType": "git",
              "lessThan": "4cafce4d6d0a66ec27e3af5637c11901d60189fa"
            },
            {
              "version": "b7fd2c0340eacbee892425e9007647568b7f2a3c",
              "status": "affected",
              "versionType": "git",
              "lessThan": "33ee909702e047c94aaf41d4eea35626d509802c"
            },
            {
              "version": "b7fd2c0340eacbee892425e9007647568b7f2a3c",
              "status": "affected",
              "versionType": "git",
              "lessThan": "17debf5586020790b5717f96e5e6a3ca5bb961ab"
            },
            {
              "version": "b7fd2c0340eacbee892425e9007647568b7f2a3c",
              "status": "affected",
              "versionType": "git",
              "lessThan": "0fc63dd9170643d15c25681fca792539e23f4640"
            },
            {
              "version": "b7fd2c0340eacbee892425e9007647568b7f2a3c",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b60b3f7a35c46b2e0ca934f9c988b8fca06d76c6"
            },
            {
              "version": "b7fd2c0340eacbee892425e9007647568b7f2a3c",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b6a94eeca9c6c8f7c55ad44c62c98324f51ec596"
            },
            {
              "version": "b7fd2c0340eacbee892425e9007647568b7f2a3c",
              "status": "affected",
              "versionType": "git",
              "lessThan": "6601e13e82841879406bf9f369032656f441a425"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "4.11",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "4.11"
            },
            {
              "version": "5.10.253",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.203",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.169",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.130",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.77",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.18",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "6.19.8",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.19.*"
            },
            {
              "version": "7.0",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}