CVE-2026-23405: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23405 is a resource exhaustion vulnerability in the Linux kernel's AppArmor security module, caused by the absence of a depth limit on nested policy namespaces. An attacker with low privileges can create arbitrarily deeply nested AppArmor policy namespaces — independent of user namespace limits — to exhaust system memory and CPU resources. The vulnerability affects the Linux kernel from version 2.6.36 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.169, 6.6.130, 6.12.77, 6.18.18, 6.19.8, and 7.0-rc4. It was published on April 1, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the AppArmor subsystem does not enforce a maximum nesting depth for policy namespaces, even though user namespaces — which AppArmor policy namespaces are loosely associated with — do have such limits. Because policy namespaces can be created and nested independently of user namespace hierarchies, a low-privileged local user can programmatically create deeply nested policy namespace trees to consume unbounded kernel memory and CPU time. The fix hard-caps the policy namespace nesting depth to match the existing user namespace depth limit (GitHub Advisory, Kernel Patch).

Successful exploitation results in a local denial-of-service condition through memory and CPU exhaustion, degrading or crashing the affected system. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems running AppArmor-enabled Linux kernels (common in Ubuntu, SUSE, and other distributions) are at risk, and the attack can be performed without user interaction by any low-privileged local account (GitHub Advisory, Microsoft MSRC).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of this report (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, which limits the attack surface compared to remotely exploitable vulnerabilities.

Update the Linux kernel to a patched version: 5.10.253 or later, 5.15.203 or later, 6.1.169 or later, 6.6.130 or later, 6.12.77 or later, 6.18.18 or later, 6.19.8 or later, or 7.0-rc4 or later. Ubuntu has issued security notices USN-8152-1, USN-8163-1, USN-8163-2, USN-8201-1, USN-8224-1, USN-8243-1, USN-8266-1, and USN-8267-1 addressing this issue; SUSE has released advisories SUSE-SU-2026:2068-1, SUSE-SU-2026:2111-1, SUSE-SU-2026:2195-1, SUSE-SU-2026:2217-1, and SUSE-SU-2026:2238-1. As a workaround where patching is not immediately feasible, restricting unprivileged namespace creation (e.g., via kernel.unprivileged_userns_clone=0 on supported distributions) can reduce exposure (GitHub Advisory, Ubuntu USN-8152-1, SUSE Advisory).

The vulnerability was covered by Qualys in a blog post titled "CrackArmor: Critical AppArmor Flaws Enable Local Privilege Escalation to Root," which grouped it with other AppArmor-related findings (Qualys Blog). Multiple Linux distribution vendors — including Ubuntu, SUSE, and openSUSE — issued timely security advisories and kernel updates. The vulnerability was also announced on the kernel CVE mailing list and oss-security, following standard Linux kernel disclosure practices (oss-sec).