CrackArmor: 9 vulnerabilities in Linux AppArmor allow root escalation

Qualys cybersecurity researchers have discovered nine critical vulnerabilities in Linux AppArmor that allow unprivileged users to escalate their privileges to root and bypass container isolation. The CrackArmor vulnerabilities have been present in the Linux kernel since 2017 and affect more than 12.6 million enterprise Linux installations worldwide. The long-standing presence of these vulnerabilities makes the situation particularly concerning for system administrators and companies that rely on AppArmor to protect their infrastructure.

See also: SolarWinds Serv-U: Critical vulnerabilities allow root access

AppArmor is a critical Linux security module that provides mandatory access control ( MAC ) and protects the operating system from external and internal threats. It has been integrated into the main Linux kernel since version 2.6.36 and is widely used in distributions such as Ubuntu , Debian , and SUSE . Its widespread adoption in enterprise environments and cloud infrastructures makes these vulnerabilities particularly dangerous, as they can affect millions of servers and containerized applications.

According to Saeed Abbasi , senior manager of the Qualys Threat Research Unit (TRU) , the CrackArmor vulnerabilities exploit a confused deputy weakness that allows unprivileged users to manipulate security profiles via pseudo-files. This leads to bypassing user-namespace restrictions and executing arbitrary code within the kernel. The nature of these attacks makes them particularly difficult to detect, as they exploit legitimate system functions for malicious purposes.

Technical details of the CrackArmor vulnerabilities

The nine vulnerabilities that make up CrackArmor are listed as CVE-2026-23235 , CVE-2026-23236 , CVE-2026-23237 , and CVE-2026-23238 . The vulnerabilities affect all Linux kernels from version 4.11 onwards, on any distribution that integrates AppArmor . The broad version coverage means that even older systems that have not been recently updated are exposed to these threats.

Confused deputy vulnerabilities occur when a privileged program is forced by an unauthorized user to misuse its privileges to perform unwanted, malicious actions. The problem exploits the trust associated with a higher-privileged tool to execute commands that lead to privilege escalation. This type of attack is particularly insidious because it uses the system's own security mechanisms against it.

See also: ClipXDaemon Malware: New Crypto Clipboard Hijacker on Linux

Qualys notes that an unauthorized entity could manipulate AppArmor profiles to disable critical service protections or enforce deny-all policies, causing denial-of-service ( DoS ) attacks in the process. In addition, the vulnerabilities allow stack exhaustion and Kernel Address Space Layout Randomization (KASLR) bypass via out-of-bounds reads, creating multiple attack vectors.

Impact on security of containers and enterprise environments

The CrackArmor have a particularly serious impact on containerized environments and enterprise cloud infrastructures. They allow unprivileged users to create fully capable user namespaces, effectively bypassing Ubuntu implemented through AppArmor. This is particularly problematic in shared hosting environments and multi-tenant cloud infrastructures where isolation between users is critical for security.

This undermines critical security safeguards such as container isolation, least privilege enforcement, and service hardening. Combined with inherent kernel-level weaknesses in profiling, attackers can bypass user-namespace restrictions and achieve local privilege escalation ( LPE ) to full root access. The ability to bypass container isolation puts entire Kubernetes and Docker infrastructures at risk

Policy manipulation compromises the entire host, while namespace bypasses facilitate advanced kernel exploits such as arbitrary memory disclosure. DoS and LPE result in service interruptions, credential tampering via passwordless root (e.g., modifying /etc/passwd), or KASLR, which allows further remote exploitation chains. In enterprise environments, this can lead to complete system compromise and theft of sensitive data.

See also: LockBit 5.0 attacks Windows, Linux & ESXI systems

Beyond immediately applying patches, organizations should implement additional security measures to detect and prevent such attacks. Monitoring AppArmor logs for unusual activity, implementing SELinux as an additional layer of security, and using runtime security tools like Falco can help detect attacks early. In addition, periodically performing controlled penetration testing and vulnerability assessments can uncover such weaknesses before they are exploited by malicious actors.