CVE-2026-23405

Vulnerability

In the Linux kernel's AppArmor security module, the number of nested policy namespaces was not bounded. Unlike user namespaces, which have a hard limit on nesting depth, AppArmor policy namespaces could be created and nested arbitrarily deep, relying only on the user namespace limit which is not strictly tied to AppArmor namespaces. This oversight allows an attacker to exhaust system resources by creating deeply nested policy namespaces.

Exploitation

A local user with the ability to create AppArmor namespaces (typically requiring CAP_MAC_ADMIN or similar privileges) can exploit this by repeatedly nesting namespaces. No network access or authentication beyond local system access is required. The attack does not depend on any other vulnerability; it is a direct resource exhaustion vector.

Impact

An attacker can cause significant memory and possibly CPU exhaustion, leading to a denial of service (DoS) condition on the affected system. The unbounded nesting consumes kernel memory for each namespace level, potentially crashing the system or making it unresponsive.

Mitigation

The fix introduces a hard cap on the depth of AppArmor policy namespaces, matching the existing limit for user namespaces. Patches have been backported to stable kernel versions [1][2][3][4]. Users should apply the latest kernel updates from their distribution to remediate this issue.