Uncontrolled Recursion in Linux kernel - CVE-2026-23404
Published: April 1, 2026
Vulnerability identifier: #VU124781
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-23404
CWE-ID: CWE-674
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to improper input validation in AppArmor profile removal functionality when handling deeply nested profiles. A local attacker can send a specially crafted request to cause a denial of service.
Exploitation requires the ability to load AppArmor profiles and trigger their removal, which is typically available to unprivileged users on systems where AppArmor is enabled.
How to mitigate CVE-2026-23404
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/33959a491e9fd557abfa5fce5ae4637d400915d3
- https://git.kernel.org/stable/c/7eade846e013cbe8d2dc4a484463aa19e6515c7f
- https://git.kernel.org/stable/c/999bd704b0b641527a5ed46f0d969deff8cfa68b
- https://git.kernel.org/stable/c/a6a941a1294ac5abe22053dc501d25aed96e48fe
- https://git.kernel.org/stable/c/ab09264660f9de5d05d1ef4e225aa447c63a8747