CVE-2026-23404apparmor: replace recursive profile removal with iterative approach
- 5.5MediumCVSS base score
- 0.18%Exploitation in 30 daysEPSS · top 92% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: apparmor: replace recursive profile removal with iterative approach The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes. Reproducer: $ pf='a'; for ((i=0; i<1024; i++)); do echo -e "profile $pf { \n }" | apparmor_parser -K -a; pf="$pf//x"; done $ echo -n a > /sys/kernel/security/apparmor/.remove Replace the recursive __aa_profile_list_release() approach with an iterative approach in __remove_profile(). The function repeatedly finds and removes leaf profiles until the entire subtree is removed, maintaining the same removal semantic without recursion.
Timeline
ID reserved
By Linux
- 3 months later
· 3 months later
Published
- 40 days later
· 40 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.18% · top 92% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected c88d4c7b049e87998ac0a9f455aa545cc895ef92 – < ea854f032190cc9f26dc4a0e727090c89e55e342
- affected c88d4c7b049e87998ac0a9f455aa545cc895ef92 – < 4fdc847b107321dec22bf8ecd6019b7af76d7886
- affected c88d4c7b049e87998ac0a9f455aa545cc895ef92 – < b36a04284d0208be94e5e401409caa00e2bf1be1
- affected c88d4c7b049e87998ac0a9f455aa545cc895ef92 – < 33959a491e9fd557abfa5fce5ae4637d400915d3
- affected c88d4c7b049e87998ac0a9f455aa545cc895ef92 – < 999bd704b0b641527a5ed46f0d969deff8cfa68b
- affected c88d4c7b049e87998ac0a9f455aa545cc895ef92 – < 7eade846e013cbe8d2dc4a484463aa19e6515c7f
- affected c88d4c7b049e87998ac0a9f455aa545cc895ef92 – < a6a941a1294ac5abe22053dc501d25aed96e48fe
- affected c88d4c7b049e87998ac0a9f455aa545cc895ef92 – < ab09264660f9de5d05d1ef4e225aa447c63a8747
- affected 2.6.36
- unaffected < 2.6.36
- unaffected 5.10.253 – ≤ 5.10.*
- unaffected 5.15.203 – ≤ 5.15.*
- unaffected 6.1.169 – ≤ 6.1.*
- unaffected 6.6.130 – ≤ 6.6.*
- unaffected 6.12.77 – ≤ 6.12.*
- unaffected 6.18.18 – ≤ 6.18.*
- unaffected 6.19.8 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References8
- https://git.kernel.org/stable/c/ea854f032190cc9f26dc4a0e727090c89e55e342 (opens in a new tab)
- https://git.kernel.org/stable/c/4fdc847b107321dec22bf8ecd6019b7af76d7886 (opens in a new tab)
- https://git.kernel.org/stable/c/b36a04284d0208be94e5e401409caa00e2bf1be1 (opens in a new tab)
- https://git.kernel.org/stable/c/33959a491e9fd557abfa5fce5ae4637d400915d3 (opens in a new tab)
- https://git.kernel.org/stable/c/999bd704b0b641527a5ed46f0d969deff8cfa68b (opens in a new tab)
- https://git.kernel.org/stable/c/7eade846e013cbe8d2dc4a484463aa19e6515c7f (opens in a new tab)
- https://git.kernel.org/stable/c/a6a941a1294ac5abe22053dc501d25aed96e48fe (opens in a new tab)
- https://git.kernel.org/stable/c/ab09264660f9de5d05d1ef4e225aa447c63a8747 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-17832 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-23404)Record last updated .