CVE-2026-90246

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer overflow exists in the AppArmor module during the validation of the tagset table unpacked from a policy blob. The verify tags() function performs a bounds check by adding an index i and a count cnt, both of which are u32 types. Because this addition is evaluated modulo 2^32, a large cnt value provided by an attacker can cause the sum to wrap around to a small value, bypassing the guard check. This allows the inner loop to read memory past the end of the sets.table[] allocation, resulting in an out-of-bounds read during the policy load path (aa replace profiles -> aa unpack -> unpack policydb -> unpack tags -> verify tags). This path can be reached by unprivileged tasks in matched-level nested namespaces when unprivileged userns apparmor policy is set to 1.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.