Linux Kernel CVE-2026-46254

Exploitation requires: (1) local authenticated access with at least low-privilege user credentials (CVSS PR:L), (2) a Linux system running on an architecture that enforces strict memory alignment - confirmed on SPARC by the kernel trace, and likely on MIPS and certain ARM variants; this vulnerability does NOT manifest on x86/x86_64 where hardware silently handles unaligned access, (3) the AppArmor LSM must be enabled and active (not disabled via kernel command line), and (4) the ability to trigger AppArmor policy loading, which in practice requires writing to AppArmor's securityfs policy interfaces (typically requiring root or a privileged policy management process). The limiting factors are the architecture dependency, local-only attack vector, and the requirement for AppArmor to be in use - on standard x86 server/desktop deployments this vulnerability does not trigger.

The CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) vector accurately characterizes this as a local, low-complexity, low-privilege denial-of-service: no confidentiality or integrity impact, with high availability impact limited to the AppArmor policy loading subsystem. The EPSS score of 0.02% at the 5th percentile is consistent with the narrow exploitation surface - this is not remotely exploitable and requires architectural preconditions not present on x86/x86_64 (the dominant server/desktop platform). No CISA KEV listing and no public exploit code further confirm this is not a priority for most organizations. The primary real-world risk is on embedded or specialized Linux deployments running AppArmor on strict-alignment RISC architectures (SPARC, certain MIPS/ARM variants). On x86 systems, unaligned access is silently handled in hardware and this vulnerability does not manifest. The risk gap between the CVSS score and practical exploitability is significant - this is a reliability/correctness fix for non-x86 platforms, not a meaningful security risk for mainstream deployments.

A local user with low privileges on a SPARC, MIPS, or strict-alignment ARM Linux system running AppArmor writes a crafted AppArmor policy blob via apparmor_parser whose DFA table data is not 8-byte aligned. The kernel's aa_dfa_unpack() function performs a direct typed memory read of the unaligned field, triggering a kernel WARNING and aborting the profile load, effectively preventing AppArmor policy from being applied to that profile. No public proof-of-concept code exists at the time of analysis, and the scenario is largely inadvertent (from standard apparmor_parser output) rather than a crafted attack.