AppArmor privileged policy management confused deputy in Linux kernel

CVE-2026-23268 is a local privilege-boundary flaw in the Linux kernel AppArmor subsystem. An unprivileged local user can open writable apparmorfs policy-management interfaces and then abuse a confused deputy condition by passing the opened file descriptor to a privileged process and inducing that process to perform the write. Because the write-side privilege validation was insufficient for this delegated file descriptor case, the attacker could cause privileged policy operations through apparmorfs, including loading, replacing, and removing AppArmor profiles. The issue specifically affects AppArmor policy management rather than a generic VFS permission bypass. Upstream fixed it by ensuring that the task writing to the interface has privileges that are a subset of the task that originally opened the interface, closing the delegation path that allowed unconfined processes to bypass the usual policy checks.