#VU124781 Uncontrolled Recursion in Linux kernel - CVE-2026-23404
Published: April 1, 2026
Vulnerability identifier: #VU124781
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-23404
CWE-ID: CWE-674
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Linux kernel
Linux kernel
Software vendor:
Linux Foundation
Linux Foundation
Description
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to improper input validation in AppArmor profile removal functionality when handling deeply nested profiles. A local attacker can send a specially crafted request to cause a denial of service.
Exploitation requires the ability to load AppArmor profiles and trigger their removal, which is typically available to unprivileged users on systems where AppArmor is enabled.
Remediation
Install security update from vendor's repository.
External links
- https://git.kernel.org/stable/c/33959a491e9fd557abfa5fce5ae4637d400915d3
- https://git.kernel.org/stable/c/7eade846e013cbe8d2dc4a484463aa19e6515c7f
- https://git.kernel.org/stable/c/999bd704b0b641527a5ed46f0d969deff8cfa68b
- https://git.kernel.org/stable/c/a6a941a1294ac5abe22053dc501d25aed96e48fe
- https://git.kernel.org/stable/c/ab09264660f9de5d05d1ef4e225aa447c63a8747