CVE-2026-23404 — Allocation of Resources Without Limits or Throttling in Linux
Severity
7.2HIGHOSV
No vectorEPSS
0.0%
top 90.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 1
Latest updateApr 19
Description
In the Linux kernel, the following vulnerability has been resolved:
apparmor: replace recursive profile removal with iterative approach
The profile removal code uses recursion when removing nested profiles,
which can lead to kernel stack exhaustion and system crashes.
Reproducer:
$ pf='a'; for ((i=0; i /sys/kernel/security/apparmor/.remove
Replace the recursive __aa_profile_list_release() approach with an
iterative approach in __remove_profile(). The function repeatedly
finds and removes lea…
Affected Packages3 packages
▶CVEListV5linux/linuxc88d4c7b049e87998ac0a9f455aa545cc895ef92 — 33959a491e9fd557abfa5fce5ae4637d400915d3+5
🔴Vulnerability Details
4VulDB▶
Linux Kernel up to 7.0-rc3 apparmor __aa_profile_list_release recursion (EUVD-2026-17832 / WID-SEC-2026-0950)↗2026-04-19
GHSA▶
GHSA-x9jq-3w57-m487: In the Linux kernel, the following vulnerability has been resolved:
apparmor: replace recursive profile removal with iterative approach
The profile↗2026-04-01
OSV▶
CVE-2026-23404: In the Linux kernel, the following vulnerability has been resolved: apparmor: replace recursive profile removal with iterative approach The profile re↗2026-04-01