Executive brief
AppArmor is a mandatory access control (MAC) security module in the Linux kernel that restricts what unprivileged users can do. A flaw in how AppArmor enforces restrictions on transitions through "unconfined" profiles allows an unprivileged attacker to bypass these restrictions by executing two consecutive profile transitions, escaping confinement and gaining unauthorized access to restricted resources or capabilities.
Technical details
The vulnerability is an authorization bypass in AppArmor's profile transition logic (security/apparmor/domain.c). When a task is already confined by a stacked AppArmor profile, the unprivileged transition restriction on the unconfined profile is not correctly applied. This allows an attacker to execute two transitions through an unconfined profile, resulting in a privilege escalation or confinement escape. The fix moves the privilege check from the aa_change_profile() function into the per-profile label build logic via a new priv_restricted_transition() function, ensuring the restriction is always evaluated against the unconfined profile and properly forced into a stack when necessary. The vulnerability affects systems where AppArmor is enabled and aa_unprivileged_unconfined_restricted is set; exploitation requires no special network access or authentication.
Affected products
- Linux Linux kernel Linux 2.6.11 through 7.2 (AppArmor subsystem)
Timeline
- 2026-09-17: disclosed
- 2026-05-08: patched: Upstream fix committed by John Johansen