Medium 5.5Published Apr 1, 2026

CVE-2026-23404apparmor: replace recursive profile removal with iterative approach

Updated under an hour ago (Oct 26, 2026, 3:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: apparmor: replace recursive profile removal with iterative approach The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes. Reproducer: $ pf='a'; for ((i=0; i<1024; i++)); do echo -e "profile $pf { \n }" | apparmor_parser -K -a; pf="$pf//x"; done $ echo -n a > /sys/kernel/security/apparmor/.remove Replace the recursive __aa_profile_list_release() approach with an iterative approach in __remove_profile(). The function repeatedly finds and removes leaf profiles until the entire subtree is removed, maintaining the same removal semantic without recursion.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c88d4c7b049e87998ac0a9f455aa545cc895ef92 before ea854f032190cc9f26dc4a0e727090c89e55e342; from c88d4c7b049e87998ac0a9f455aa545cc895ef92 before 4fdc847b107321dec22bf8ecd6019b7af76d7886; from c88d4c7b049e87998ac0a9f455aa545cc895ef92 before b36a04284d0208be94e5e401409caa00e2bf1be1; from c88d4c7b049e87998ac0a9f455aa545cc895ef92 before 33959a491e9fd557abfa5fce5ae4637d400915d3; from c88d4c7b049e87998ac0a9f455aa545cc895ef92 before 999bd704b0b641527a5ed46f0d969deff8cfa68b; from c88d4c7b049e87998ac0a9f455aa545cc895ef92 before 7eade846e013cbe8d2dc4a484463aa19e6515c7f; from c88d4c7b049e87998ac0a9f455aa545cc895ef92 before a6a941a1294ac5abe22053dc501d25aed96e48fe; from c88d4c7b049e87998ac0a9f455aa545cc895ef92 before ab09264660f9de5d05d1ef4e225aa447c63a8747	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.36.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.169; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.18; from 6.19 before 6.19.8; 2.6.36; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/ea854f032190cc9f26dc4a0e727090c89e55e342	patch
https://git.kernel.org/stable/c/4fdc847b107321dec22bf8ecd6019b7af76d7886	patch
https://git.kernel.org/stable/c/b36a04284d0208be94e5e401409caa00e2bf1be1	patch
https://git.kernel.org/stable/c/33959a491e9fd557abfa5fce5ae4637d400915d3	patch
https://git.kernel.org/stable/c/999bd704b0b641527a5ed46f0d969deff8cfa68b	patch
https://git.kernel.org/stable/c/7eade846e013cbe8d2dc4a484463aa19e6515c7f	patch
https://git.kernel.org/stable/c/a6a941a1294ac5abe22053dc501d25aed96e48fe	patch
https://git.kernel.org/stable/c/ab09264660f9de5d05d1ef4e225aa447c63a8747	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.