UBUNTU-CVE-2026-46254: Low severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: AppArmor: Allow apparmor to handle unaligned dfa tables The dfa tables can originate from kernel or userspace and 8-byte alignment isn't always guaranteed and as such may trigger unaligned memory accesses on various architectures. Resulting in the following [ 73.901376] WARNING: CPU: 0 PID: 341 at security/apparmor/match.c:316 aadfaunpack+0x6cc/0x720 [ 74.015867] Modules linked in: binfmtmisc evdev flash sg drm drmpanelorientationquirks backlight i2ccore configfs nfnetlink autofs4 ext4 crc16 mbcache jbd2 hidgeneric usbhid srmod hid cdrom sdmod atageneric ohcipci ehcipci ehcihcd ohcihcd pataali libata sym53c8xx scsitransportspi tg3 scsimod usbcore libphy scsicommon mdiobus usbcommon [ 74.428977] CPU: 0 UID: 0 PID: 341 Comm: apparmorparser Not tainted 6.18.0-rc6+ #9 NONE [ 74.536543] Call Trace: [ 74.568561] [<0000000000434c24>] dumpstack+0x8/0x18 [ 74.633757] [<0000000000476438>] warn+0xd8/0x100 [ 74.696664] [<00000000004296d4>] warnslowpathfmt+0x34/0x74 [ 74.771006] [<00000000008db28c>] aadfaunpack+0x6cc/0x720 [ 74.843062] [<00000000008e643c>] unpackpdb+0xbc/0x7e0 [ 74.910545] [<00000000008e7740>] unpackprofile+0xbe0/0x1300 [ 74.984888] [<00000000008e82e0>] aaunpack+0xe0/0x6a0 [ 75.051226] [<00000000008e3ec4>] aareplaceprofiles+0x64/0x1160 [ 75.130144] [<00000000008d4d90>] policyupdate+0xf0/0x280 [ 75.201057] [<00000000008d4fc8>] profilereplace+0xa8/0x100 [ 75.274258] [<0000000000766bd0>] vfswrite+0x90/0x420 [ 75.340594] [<00000000007670cc>] ksyswrite+0x4c/0xe0 [ 75.406932] [<0000000000767174>] syswrite+0x14/0x40 [ 75.472126] [<0000000000406174>] linuxsparcsyscall+0x34/0x44 [ 75.548802] ---[ end trace 0000000000000000 ]--- [ 75.609503] dfa blob stream 0xfff0000008926b96 not aligned. [ 75.682695] Kernel unaligned access at TPC[8db2a8] aadfaunpack+0x6e8/0x720 Work around it by using the getunalignedxx() helpers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.71~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1062.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-136.136~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1058.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1055.56~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-134.134 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1063.71 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1039.42 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1058.64 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1045.48 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1060.61 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1058.61 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1058.61.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1029.30 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1057.58 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1060.64 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1032.33 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1026.30 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2049.50 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1055.56 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-134.134+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69+fips1 - Compensating control
In the Linux kernel's AppArmor aa_dfa_unpack handling, use the get_unaligned_xx() helpers to read DFA table data and avoid unaligned memory accesses.
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
AppArmor must process a DFA table that is not 8-byte aligned. Such tables can originate from either the kernel or userspace, and processing them can cause unaligned memory accesses on affected architectures.
Who is most likely to be exposed?
Systems using AppArmor are relevant, particularly on architectures where unaligned memory accesses trigger warnings or faults. The provided data identifies Ubuntu linux, linux-azure, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux-gcp, and linux-oracle packages.
How can administrators identify a possible occurrence?
Look for kernel warnings involving aa_dfa_unpack in security/apparmor/match.c, potentially with apparmor_parser shown as the triggering process. The example reports a warning at aa_dfa_unpack while unpacking AppArmor policy data.