CVE-2026-23404 Overview
CVE-2026-23404 is a denial-of-service vulnerability in the Linux kernel's AppArmor subsystem. The flaw resides in the profile removal code path, which uses recursion to tear down nested profiles. A local user with permission to load AppArmor profiles can construct a deeply nested profile hierarchy and trigger kernel stack exhaustion during removal, leading to a system crash. The issue affects __aa_profile_list_release() and has been resolved by replacing the recursive implementation with an iterative approach in __remove_profile().
Critical Impact
A local, low-privileged user able to interact with the AppArmor securityfs interface can crash the kernel by removing a deeply nested profile tree, causing availability loss on affected Linux systems.
Affected Products
- Linux kernel (mainline, prior to fix commits listed by kernel.org)
- Linux kernel 2.6.36 and subsequent long-term stable branches incorporating AppArmor profile removal logic
- Linux kernel 7.0 release candidates (rc1 through rc7)
Discovery Timeline
- 2026-04-01 - CVE-2026-23404 published to the National Vulnerability Database (NVD)
- 2026-04-24 - Last updated in the NVD database
Technical Details for CVE-2026-23404
Vulnerability Analysis
The vulnerability is a kernel-mode denial of service caused by unbounded recursion during AppArmor profile teardown. AppArmor allows administrators to define profiles and child profiles, forming a tree structure. When a parent profile is removed via the .remove securityfs interface, the kernel walks the child hierarchy and frees each node.
The original implementation in __aa_profile_list_release() recursed into each child profile before releasing the parent. Each recursive call consumed a kernel stack frame. Because kernel stacks are small and fixed (typically 16KB on x86_64), a sufficiently deep profile chain overflows the stack and triggers a kernel panic.
Root Cause
The root cause is a design choice in the profile cleanup path: recursion over user-controllable nesting depth. AppArmor places no practical limit on how deeply profiles can be nested using the // child separator. An attacker who can invoke apparmor_parser to load profiles, or who can write to the AppArmor securityfs control files, controls that depth. Removing the root of the chain forces the kernel to recurse once per level, exhausting the stack.
The upstream fix replaces the recursive walker with an iterative loop in __remove_profile(). The function repeatedly locates and removes leaf profiles until the entire subtree is gone, preserving the original removal semantics while bounding stack usage to a constant.
Attack Vector
Exploitation requires local access and the privilege to load AppArmor profiles, typically CAP_MAC_ADMIN. The reproducer published with the patch loads 1024 nested profiles using apparmor_parser -K -a with names of the form a//x//x//x..., then writes the root profile name to /sys/kernel/security/apparmor/.remove. The write triggers recursive teardown and crashes the kernel. No remote vector exists; the impact is confined to availability on the local host.
Detection Methods for CVE-2026-23404
Indicators of Compromise
- Unexpected kernel panics or BUG: stack guard page was hit messages referencing __aa_profile_list_release or AppArmor profile cleanup functions in dmesg or /var/log/kern.log.
- Sudden host reboots correlated with writes to /sys/kernel/security/apparmor/.remove.
- Audit log entries showing unusually deep AppArmor profile names containing many // separators.
Detection Strategies
- Monitor auditd for AppArmor profile load operations (type=APPARMOR_STATUS, operation="profile_load") where profile names exceed reasonable nesting depth.
- Alert on processes writing to /sys/kernel/security/apparmor/.remove, especially from non-administrative service accounts.
- Correlate kernel oops or panic events with preceding AppArmor profile manipulation within a short time window.
Monitoring Recommendations
- Forward kernel ring buffer and audit logs to a centralized logging platform for retention and search across hosts.
- Track which users and binaries invoke apparmor_parser, and flag invocations that load profiles with extreme name lengths or nesting.
- Watch for unexplained host availability dips on systems where AppArmor is enabled and profiles are administratively managed.
How to Mitigate CVE-2026-23404
Immediate Actions Required
- Apply the upstream Linux stable kernel update containing the iterative __remove_profile() fix and reboot affected hosts.
- Restrict CAP_MAC_ADMIN and write access to /sys/kernel/security/apparmor/.remove to trusted administrators only.
- Audit existing AppArmor profiles for unusually deep nesting and remove suspicious entries before patching, to avoid triggering the bug during update reboots.
Patch Information
The fix is committed to the mainline and stable Linux kernel trees. Relevant commits include Linux Kernel Commit 33959a4, Linux Kernel Commit 4fdc847, Linux Kernel Commit 7eade84, Linux Kernel Commit 999bd70, Linux Kernel Commit a6a941a, Linux Kernel Commit ab09264, Linux Kernel Commit b36a042, and Linux Kernel Commit ea854f0. Consume the patch through your distribution's kernel update channel.
Workarounds
- Limit who can load or remove AppArmor profiles by tightening sudo policies and revoking CAP_MAC_ADMIN from service accounts that do not require it.
- Add file access controls or mount options that prevent unprivileged writes to /sys/kernel/security/apparmor/.remove on multi-tenant systems.
- Where AppArmor is not required, consider disabling profile management at runtime until the patched kernel is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
