CVE-2026-23404: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23404 is a kernel stack exhaustion vulnerability in the Linux kernel's AppArmor security module caused by unbounded recursion during nested profile removal. When removing deeply nested AppArmor profiles, the __aa_profile_list_release() function recurses without limit, which can exhaust the kernel stack and cause a system crash. The vulnerability affects Linux kernel versions from 2.6.36 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.169, 6.6.130, 6.12.77, 6.18.18, 6.19.8, and 7.0-rc4. It was published on April 1, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Microsoft MSRC).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): the AppArmor profile removal code in __aa_profile_list_release() uses recursion to traverse and remove nested child profiles, with no depth limit enforced. An attacker with local low-privilege access can create approximately 1,024 levels of nested AppArmor profiles using apparmor_parser -K -a, then trigger removal by writing the top-level profile name to /sys/kernel/security/apparmor/.remove. Each recursive call consumes kernel stack space, and at sufficient depth the stack is exhausted, causing a kernel panic. The fix replaces the recursive approach in __remove_profile() with an iterative leaf-removal loop that maintains the same removal semantics without unbounded stack growth (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in kernel stack exhaustion and a system crash (kernel panic), causing a complete denial of service on the affected host. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Any local user with low privileges who can load and remove AppArmor profiles can trigger this condition, making it a risk in multi-tenant or shared Linux environments where AppArmor is enabled (GitHub Advisory, Microsoft MSRC).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to interact with the AppArmor subsystem, limiting the attack surface to authenticated local users or processes.

1. Gain local access: Obtain a low-privilege shell on a target Linux system running a vulnerable kernel version with AppArmor enabled.
2. Create deeply nested profiles: Use apparmor_parser to iteratively load 1,024 levels of nested profiles, each containing the next as a child:

   pf='a'; for ((i=0; i<1024; i++)); do
       echo -e "profile $pf { \n }" | apparmor_parser -K -a;
       pf="$pf//x";
   done

3. Trigger recursive removal: Write the top-level profile name to the AppArmor remove interface to initiate the recursive removal:

   echo -n a > /sys/kernel/security/apparmor/.remove

4. Stack exhaustion: The kernel's __aa_profile_list_release() function recurses ~1,024 levels deep, exhausting the kernel stack and triggering a kernel panic, crashing the system (GitHub Advisory).

• Logs: Kernel panic or oops messages in /var/log/kern.log or dmesg output referencing stack overflow or AppArmor-related call traces (e.g., __aa_profile_list_release, __remove_profile).
• Logs: Audit logs (/var/log/audit/audit.log) showing a high volume of AppArmor profile load events (apparmor_parser -K -a) from a single user or process in rapid succession.
• File System: Presence of a large number of deeply nested AppArmor profiles visible via aa-status or in /sys/kernel/security/apparmor/profiles.
• Process: Unusual or repeated invocations of apparmor_parser by non-administrative users, particularly with the -K (keep) and -a (add) flags.
• System: Unexpected system reboots or kernel panics on systems with AppArmor enabled, without other apparent hardware or software cause.

Apply the patched Linux kernel versions released for each affected stable branch: 5.10.253+, 5.15.203+, 6.1.169+, 6.6.130+, 6.12.77+, 6.18.18+, 6.19.8+, or 7.0-rc4+. Ubuntu users should apply the relevant USN advisories (e.g., USN-8152-1, USN-8163-1, USN-8201-1, USN-8224-1, USN-8243-1, USN-8266-1, USN-8267-1); SUSE users should apply SUSE-SU-2026:2068-1, SUSE-SU-2026:2111-1, SUSE-SU-2026:2195-1, SUSE-SU-2026:2217-1, and SUSE-SU-2026:2238-1. As a workaround where patching is not immediately possible, restrict local user access to the AppArmor sysfs interface and limit which users can load or remove AppArmor profiles (GitHub Advisory, Ubuntu USN-8152-1, SUSE Advisory).

Qualys published a blog post titled "CrackArmor: Critical AppArmor Flaws Enable Local Privilege Escalation to Root" that references this and related AppArmor vulnerabilities, indicating broader researcher interest in the AppArmor attack surface (Qualys Blog). The vulnerability was also announced on the kernel CVE mailing list and the oss-security list shortly after disclosure. Multiple Linux distributions including Ubuntu and SUSE issued security advisories promptly, reflecting standard coordinated patch distribution for kernel vulnerabilities.