Improper access control in Linux kernel - CVE-2026-90231
Published: September 18, 2026
Vulnerability identifier: #VU151258
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90231
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escape AppArmor confinement.
The vulnerability exists due to improper access control in AppArmor profile transition handling when executing two transitions through an unconfined profile. A local user can execute two transitions through an unconfined profile to escape AppArmor confinement.
The issue applies when unprivileged transitions to unconfined profiles are restricted.
Affected software
Linux kernel
How to mitigate CVE-2026-90231
Install security update from vendor's repository.