Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 6.17, and 7.0 contain AppArmor patches that incorrectly validate the size of an internal structure, resulting in a out-of-bounds read in the notification handling code. This bug can be triggered by an unprivileged local user, and it can lead to information disclosure from adjace...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 6.17, and 7.0 contain AppArmor SAUCE patches that may potentially incorrectly calculate the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. This bug can be triggered by an unprivileged local user, and it can result in invali...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: AppArmor: A memory leak has been fixed in multitransactionnew. In multitransactionnew, the variable t is not freed or passed away after a failure in the copyfromusert-data, buf, size operation. This could lead to a memory leak...

The vulnerability of the apparmor module in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the apparmor module in Linux operating systems is related to a countable amount of significance loss. Exploiting this vulnerability can allow an attacker to cause a service failure...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in client/llb/exec.go and executor/oci/speclinux.go. An attacker can disable Seccomp and AppArmor protections for a build container by supplying a crafted build request with an invalid...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in client/llb/exec.go and executor/oci/speclinux.go. An attacker can disable Seccomp and AppArmor protections for a build container by supplying a crafted build request with an invalid...

BuildKit: Custom frontend could bypass Seccomp/AppArmor

Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers...

GHSA-7236-3392-C5C6 BuildKit: Custom frontend could bypass Seccomp/AppArmor

Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers...

AZL-97032 CVE-2026-61711 affecting package moby-engine 25.0.3-19

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

CVE-2026-61711

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

CVE-2026-61711

In BuildKit versions prior to 0.31.1, the file executor/oci/spec_linux.go treated an invalid SecurityMode value from a crafted build request as non-sandbox mode without requiring the security.insecure entitlement, disabling Seccomp and AppArmor protections for the build container. Linux capabilit...

CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

EUVD-2026-62838

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

CVE-2026-72462

A flaw was found in the Linux kernel's AppArmor security module. A race condition exists in the Unix socket mediation when handling the peerpath. This allows for a race with unixreleasesock due to accessing the peer socket path outside of the necessary state lock. This could potentially lead to...

CVE-2026-72455

A flaw was found in the AppArmor security module of the Linux kernel. A bug in the pathname function, related to handling aanull files, may cause an uninitialized pointer to be passed to aaauditfile. This can lead to a kernel page fault, resulting in a system crash and a Denial of Service DoS for...

CVE-2026-72461

A flaw was found in the AppArmor security module of the Linux kernel. This vulnerability, a reference count leak when updating the skctx, occurs because a reference is unconditionally put by the caller even when it has been transferred. A local attacker could exploit this flaw to cause a denial o...

CVE-2026-72456

A flaw was found in AppArmor within the Linux kernel. When the getcurrentexepath function encounters a path resolution failure, it fails to properly release file and path references. This resource leak could be exploited by a local attacker, potentially leading to a Denial of Service DoS by...

CVE-2026-72459

A flaw was found in the AppArmor security module of the Linux kernel. The aalabelalloc function, responsible for allocating security labels, did not properly free all allocated resources in its error handling path. This oversight could lead to a memory leak, potentially impacting system stability...