Linux Kernel CVE-2026-90246

Requires local access and the ability to load an AppArmor policy blob. Exploitation is gated by aa_may_manage_policy(), which checks CAP_MAC_ADMIN relative to the caller's own user namespace; with the distribution default unprivileged_userns_apparmor_policy=1 an unprivileged user in a matched-level nested user namespace can reach the path, otherwise CAP_MAC_ADMIN in the init namespace is required. The attacker must supply a crafted policy blob containing a tagset with a count value near U32_MAX (e.g. sets.size=2, table={0, 0xffffffff}) to trigger the i+cnt wrap; unpack_tags() runs before perms/DFA tables, so no other table needs to be well-formed. Limiting factors: local-only vector, requires either the non-guaranteed default userns policy setting or CAP_MAC_ADMIN, and the outcome is predominantly a kernel crash rather than data exposure.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, base 7.1) frames this as a locally exploitable, low-privilege memory-safety flaw. All exploitation signals point to LOW real-world urgency despite the High rating: no EPSS score is provided, the CVE is not on CISA KEV, and no public exploit code is identified - so the correct status is 'no public exploit identified at time of analysis.' The technical reality is an integer-overflow-driven out-of-bounds READ on the AppArmor policy-load path; the walk continues reading table entries until a value fails a bound or the access faults, so the primary observable outcome is a kernel crash/DoS (A:H), while the vendor's C:H (confidentiality) is optimistic - the out-of-bounds words are compared internally against hdrs.size rather than being returned to the attacker, making any information disclosure marginal. My independent assessment is closer to C:L/I:N/A:H (~5.4-6.1). One genuinely notable factor raising reachability above a typical local bug: with the distro-default unprivileged_userns_apparmor_policy=1, aa_may_manage_policy() checks CAP_MAC_ADMIN against the subject's own (nested) user namespace, so an unprivileged local user in a matched-level userns can load the crafted policy - consistent with PR:L, not PR:N. CWE is listed as N/A but should be CWE-190 (integer overflow) leading to CWE-125 (out-of-bounds read).

An unprivileged local user creates a nested user namespace (default-enabled on Ubuntu/SUSE via unprivileged_userns_apparmor_policy=1) and calls the AppArmor policy-replace interface with a crafted policy blob whose tagset table contains a count near 0xFFFFFFFF. The bounds check i+cnt >= sets.size wraps to a small value and passes, and verify_tags() walks past the end of the kcalloc'd table, producing an out-of-bounds read that typically faults and crashes the kernel (DoS). No public exploit code is identified at time of analysis.