CVE-2026-23404

Vulnerability

CVE-2026-23404 is a kernel stack exhaustion vulnerability in the Linux kernel's AppArmor security module. The __aa_profile_list_release() function used recursion to remove nested AppArmor profiles, which could lead to kernel stack exhaustion and system crashes when deeply nested profiles are deleted.

Exploitation

The vulnerability is triggered by creating a large number of nested AppArmor profiles using the apparmor_parser utility, then attempting to remove them by writing to /sys/kernel/security/apparmor/.remove. The reproducible attack involves creating 1024+ nested profiles, which causes the recursive removal function to overflow the kernel stack [1].

Impact

An attacker with local access to a system using AppArmor can cause a kernel stack overflow, leading to a denial of service via system crash. The CVSS v3 score of 5.5 reflects a medium severity, with the attack requiring local access and specific manipulation of AppArmor profiles [1].

Mitigation

The fix replaces the recursive __aa_profile_list_release() with an iterative approach in __remove_profile(), which repeatedly finds and removes leaf profiles until the entire subtree is removed, maintaining the same semantics without recursion [1]. The patch has been backported to multiple stable kernel trees [2][3][4].