FlawAtlas
Search the atlas
CVE-2026-23404 Not scored

apparmor: replace recursive profile removal with iterative approach

In the Linux kernel, the following vulnerability has been resolved: apparmor: replace recursive profile removal with iterative approach The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes. Reproducer: $ pf='a'; for ((i=0; i<1024; i++)); do echo -e "profile $pf { \n }" | apparmor_parser -K -a; pf="$pf//x"; done $ echo -n a > /sys/kernel/security/apparmor/.remove Replace the recursive __aa_profile_list_release() approach with an iterative approach in __remove_profile(). The function repeatedly finds and removes leaf profiles until the entire subtree is removed, maintaining the same removal semantic without recursion.

Exploit probability 0.2%
Published April 1, 2026
Required by Not available
Last source change July 15, 2026

02 / AFFECTED SOFTWARE

Affected packages

Linux Kernel
Unknown Unknown

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2026:20826-1
related SUSE-SU-2026:2068-1
related SUSE-SU-2026:2111-1
related SUSE-SU-2026:21841-1
related SUSE-SU-2026:21845-1
related SUSE-SU-2026:21860-1
related SUSE-SU-2026:2202-1
related SUSE-SU-2026:2215-1
related SUSE-SU-2026:2216-1
related SUSE-SU-2026:2217-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2026-23404

In the Linux kernel, the following vulnerability has been resolved: apparmor: replace recursive profile removal with iterative approach The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes. Reproducer: $ pf='a'; for ((i=0; i<1024; i++)); do echo -e "profile $pf { \n }" | apparmor_parser -K -a; pf="$pf//x"; done $ echo -n a > /sys/kernel/security/apparmor/.remove Replace the recursive __aa_profile_list_release() approach with an iterative approach in __remove_profile(). The function repeatedly finds and removes leaf profiles until the entire subtree is removed, maintaining the same removal semantic without recursion.

View original source

05 / REFERENCES

Further evidence