SB2026040163 - Uncontrolled Recursion in Linux kernel apparmor
Published: April 1, 2026
Security Bulletin ID
SB2026040163
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Uncontrolled Recursion (CVE-ID: CVE-2026-23404)
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to improper input validation in AppArmor profile removal functionality when handling deeply nested profiles. A local attacker can send a specially crafted request to cause a denial of service.
Exploitation requires the ability to load AppArmor profiles and trigger their removal, which is typically available to unprivileged users on systems where AppArmor is enabled.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/33959a491e9fd557abfa5fce5ae4637d400915d3
- https://git.kernel.org/stable/c/7eade846e013cbe8d2dc4a484463aa19e6515c7f
- https://git.kernel.org/stable/c/999bd704b0b641527a5ed46f0d969deff8cfa68b
- https://git.kernel.org/stable/c/a6a941a1294ac5abe22053dc501d25aed96e48fe
- https://git.kernel.org/stable/c/ab09264660f9de5d05d1ef4e225aa447c63a8747