CVE-2026-23404: Linux Kernel AppArmor DoS Vulnerability

CVE-2026-23404 Overview

A stack exhaustion vulnerability has been identified in the Linux kernel's AppArmor security module. The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes. This vulnerability affects the __aa_profile_list_release() function, where deeply nested security profiles can trigger unbounded recursive calls during removal operations.

Critical Impact

Local attackers can cause kernel stack exhaustion leading to system crashes and denial of service by creating deeply nested AppArmor profiles and triggering their removal.

Affected Products

• Linux kernel with AppArmor security module enabled
• Systems using AppArmor for mandatory access control
• Linux distributions with default AppArmor configurations

Discovery Timeline

• 2026-04-01 - CVE CVE-2026-23404 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-23404

Vulnerability Analysis

The vulnerability exists in the AppArmor security module's profile management code within the Linux kernel. When security profiles are organized in a nested hierarchy and subsequently removed, the kernel uses a recursive function __aa_profile_list_release() to traverse and remove each profile in the tree structure.

The recursive approach becomes problematic when dealing with deeply nested profile hierarchies. Each recursive call consumes kernel stack space, and the kernel stack is strictly limited (typically 8KB or 16KB depending on architecture). An attacker can create thousands of nested profiles, and when attempting to remove the root profile, the recursive removal process exhausts the available kernel stack space.

The fix replaces the recursive approach with an iterative algorithm in the __remove_profile() function. This iterative method repeatedly finds and removes leaf profiles from the profile tree until the entire subtree is removed, maintaining the same removal semantics without the stack consumption risks of recursion.

Root Cause

The root cause is the use of unbounded recursion in the __aa_profile_list_release() function when processing nested AppArmor profile hierarchies. The kernel stack has fixed limits, and the recursive implementation does not account for scenarios where profile nesting depth exceeds stack capacity. This design flaw allows local users to trigger stack overflow conditions through legitimate kernel interfaces.

Attack Vector

The attack requires local access and the ability to load AppArmor profiles. An attacker can exploit this vulnerability by:

1. Creating deeply nested AppArmor profiles using apparmor_parser with the compile-and-add flags
2. Triggering profile removal through the /sys/kernel/security/apparmor/.remove interface
3. Causing kernel stack exhaustion during the recursive removal process

The vulnerability can be triggered with approximately 1024 nested profiles to reliably exhaust the kernel stack. The attack does not require elevated privileges beyond the ability to manage AppArmor profiles, which may be available to certain system users or containers depending on the system configuration.

Detection Methods for CVE-2026-23404

Indicators of Compromise

• Unexpected system crashes or kernel panics with stack overflow messages
• Large numbers of deeply nested AppArmor profiles visible in /sys/kernel/security/apparmor/profiles
• Unusual activity involving apparmor_parser with profile creation loops
• System log entries indicating stack exhaustion in AppArmor-related kernel functions

Detection Strategies

• Monitor for kernel panic events with stack traces containing AppArmor functions like __aa_profile_list_release or __remove_profile
• Implement alerts for unusual patterns of AppArmor profile creation, especially rapid sequential profile additions
• Use kernel tracing tools to detect excessive recursion depth in security module operations
• Deploy EDR solutions capable of detecting denial-of-service attack patterns targeting kernel subsystems

Monitoring Recommendations

• Enable kernel crash dump collection to capture diagnostic information from stack exhaustion events
• Configure auditd rules to monitor access to /sys/kernel/security/apparmor/.remove and apparmor_parser execution
• Implement rate limiting or quotas for AppArmor profile creation where possible
• Review SentinelOne's kernel protection capabilities for detecting and preventing stack-based attacks

How to Mitigate CVE-2026-23404

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the iterative profile removal fix
• Review and limit permissions for AppArmor profile management to trusted administrators only
• Monitor systems for signs of exploitation attempts or unusual AppArmor profile activity
• Consider temporarily restricting access to AppArmor management interfaces on critical systems

Patch Information

The Linux kernel maintainers have released patches that replace the recursive profile removal approach with an iterative implementation. The fix is available through multiple kernel change log entries:

• Kernel Commit 33959a491e9f
• Kernel Commit 7eade846e013
• Kernel Commit 999bd704b0b6
• Kernel Commit a6a941a1294a
• Kernel Commit ab09264660f9

Apply the appropriate patch for your kernel version through your Linux distribution's package manager or by compiling from source with the fix applied.

Workarounds

• Restrict access to AppArmor profile management interfaces by limiting write permissions to /sys/kernel/security/apparmor/.remove
• Implement administrative controls to prevent unauthorized users from loading AppArmor profiles with apparmor_parser
• Monitor and limit the maximum depth of nested profiles through policy or administrative procedures
• Consider using SELinux or other MAC systems as alternatives if AppArmor cannot be patched immediately

# Restrict access to AppArmor removal interface
chmod 600 /sys/kernel/security/apparmor/.remove
chown root:root /sys/kernel/security/apparmor/.remove

# Audit AppArmor management activity
auditctl -w /sys/kernel/security/apparmor/.remove -p w -k apparmor_remove
auditctl -w /usr/sbin/apparmor_parser -p x -k apparmor_parser_exec