CVE-2026-90231 (GCVE-0-2026-90231)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-09-18 17:53
VLAI
Title
apparmor: fix unconfined user namespace restriction forced stack
Summary
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitions through an unconfined profile can be executed. Fix this by pushing the check into the per profile label build. The check will always be done against unconfined and result in a stack of just the unconfined component when necessary.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2d9da9b188b8cd3b579d7ef5ba5d334be9dd38fc , < 7d1099b86356df81c379159bfb8a598aaf83ce81 (git)
Affected: 2d9da9b188b8cd3b579d7ef5ba5d334be9dd38fc , < 7da0bdf0610f6d35bbb061536a47fc41646306f0 (git)
Affected: 2d9da9b188b8cd3b579d7ef5ba5d334be9dd38fc , < 08c2f7c8d4b1434cfae006f3daf4d1bce330b57b (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/domain.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d1099b86356df81c379159bfb8a598aaf83ce81",
              "status": "affected",
              "version": "2d9da9b188b8cd3b579d7ef5ba5d334be9dd38fc",
              "versionType": "git"
            },
            {
              "lessThan": "7da0bdf0610f6d35bbb061536a47fc41646306f0",
              "status": "affected",
              "version": "2d9da9b188b8cd3b579d7ef5ba5d334be9dd38fc",
              "versionType": "git"
            },
            {
              "lessThan": "08c2f7c8d4b1434cfae006f3daf4d1bce330b57b",
              "status": "affected",
              "version": "2d9da9b188b8cd3b579d7ef5ba5d334be9dd38fc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/domain.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix unconfined user namespace restriction forced stack\n\nIf a task is already confined by a stack the unprivileged transition\nrestriction on unconfined is not correctly, applied. This results in\nan escape if two transitions through an unconfined profile can be\nexecuted.\n\nFix this by pushing the check into the per profile label build. The\ncheck will always be done against unconfined and result in a stack of\njust the unconfined component when necessary."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker reaches aa_change_profile() by writing a changeprofile or exec command to /proc/self/attr/current or /proc/self/attr/exec (proc_pid_attr_write \u2192 apparmor_setprocattr \u2192 do_setattr) or via lsm_set_self_attr(2); the profile name is local process input, not a remote protocol message.\nAC:L - Success is two attacker-driven writes plus execve. The vulnerable gate is the pointer test label == \u0026labels_ns(label)-\u003eunconfined-\u003elabel in aa_change_profile(), so the first transition off the ns unconfined sentinel makes the second skip forced stacking; change_profile_perms() allows any target from a profile_unconfined() component, with no race.\nPR:L - Writing /proc/self/attr/current or /proc/self/attr/exec requires only that the opener is current (proc_pid_attr_write); there is no capable() check. The intended victims are tasks that fail cap_capable(current_cred(), \u0026init_user_ns, CAP_MAC_OVERRIDE), so a plain unprivileged local user, including one with caps only in a user namespace, suffices.\nUI:N - The attacker opens and writes their own /proc/self/attr/current or /proc/self/attr/exec, then execve()s to apply AA_CHANGE_ONEXEC; no other user must mount media, open a file, or confirm the transition.\nS:C - fn_label_build_in_scope() then aa_replace_current_label() drop the stacked ns unconfined profile that AppArmor was using as the MAC authority on the task, so later hooks (apparmor_userns_create, file mediation) run outside the policy that stack was required to keep applied\u2014an AppArmor policy/sandbox escape.\nC:H - After the second aa_change_profile()/handle_onexec() build, the task\u2019s label no longer includes ns unconfined, so AppArmor no longer denies reads a stacked or confined profile would have blocked, and a remaining FLAG_UNCONFINED label skips apparmor_userns_create() mediation, exposing userns-gated kernel interfaces the restriction was meant to hide.\nI:H - The same aa_replace_current_label() replacement lets the task perform writes and capability-using operations AppArmor was mediating, including unshare(CLONE_NEWUSER) from a FLAG_UNCONFINED profile, yielding CAP_SYS_ADMIN/CAP_NET_ADMIN in that namespace\u2014the integrity of the MAC policy the forced stack was supposed to preserve.\nA:N - The flaw only skips the forced-stack conversion in aa_change_profile()/handle_onexec(); it does not dereference invalid pointers, corrupt memory, or trigger BUG_ON, oops, panic, or deadlock."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:59.067Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7d1099b86356df81c379159bfb8a598aaf83ce81"
        },
        {
          "url": "https://git.kernel.org/stable/c/7da0bdf0610f6d35bbb061536a47fc41646306f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/08c2f7c8d4b1434cfae006f3daf4d1bce330b57b"
        }
      ],
      "title": "apparmor: fix unconfined user namespace restriction forced stack",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90231",
    "datePublished": "2026-09-17T16:07:38.613Z",
    "dateReserved": "2026-09-11T19:38:34.794Z",
    "dateUpdated": "2026-09-18T17:53:59.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90231",
      "date": "2026-09-25",
      "epss": "0.0017",
      "percentile": "0.05563"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "security/apparmor/domain.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7d1099b86356df81c379159bfb8a598aaf83ce81",
                    "status": "affected",
                    "version": "2d9da9b188b8cd3b579d7ef5ba5d334be9dd38fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7da0bdf0610f6d35bbb061536a47fc41646306f0",
                    "status": "affected",
                    "version": "2d9da9b188b8cd3b579d7ef5ba5d334be9dd38fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "08c2f7c8d4b1434cfae006f3daf4d1bce330b57b",
                    "status": "affected",
                    "version": "2d9da9b188b8cd3b579d7ef5ba5d334be9dd38fc",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "security/apparmor/domain.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix unconfined user namespace restriction forced stack\n\nIf a task is already confined by a stack the unprivileged transition\nrestriction on unconfined is not correctly, applied. This results in\nan escape if two transitions through an unconfined profile can be\nexecuted.\n\nFix this by pushing the check into the per profile label build. The\ncheck will always be done against unconfined and result in a stack of\njust the unconfined component when necessary."
          }
        ],
        "id": "CVE-2026-90231",
        "lastModified": "2026-09-18T18:17:48.137",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 5.8,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:18.930",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/08c2f7c8d4b1434cfae006f3daf4d1bce330b57b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7d1099b86356df81c379159bfb8a598aaf83ce81"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7da0bdf0610f6d35bbb061536a47fc41646306f0"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.