CVE-2026-90231 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix unconfined user namespace restriction forced stack
If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitions through an unconfined profile can be executed.
Fix this by pushing the check into the per profile label build. The check will always be done against unconfined and result in a stack of just the unconfined component when necessary.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's AppArmor mandatory access control system contains a critical logic flaw regarding the enforcement of confinement boundaries within user namespaces, specifically involving the handling of unprivileged transitions through unconfined profiles. This vulnerability arises from an incorrect application of restrictions designed to prevent tasks that are already confined by a policy stack from transitioning into or being restricted by an unconfined profile in a way that effectively bypasses existing security controls. When a task is operating under a specific AppArmor confinement, the system is expected to maintain strict boundaries and ensure that any subsequent transitions adhere to the established security context. However, due to this implementation error, the mechanism intended to restrict such transitions fails to trigger correctly when two consecutive transitions occur through an unconfined profile. This failure allows for a scenario where the cumulative effect of these transitions results in a state that violates the original confinement constraints, effectively creating an escape from the expected security domain.
From a technical perspective, the root cause lies in how the AppArmor label building process handles stack operations during policy enforcement. The vulnerability stems from the fact that the check for unconfined status was not being applied consistently within the per-profile label construction logic. Instead of ensuring that every transition respects the global restriction against allowing confined tasks to leverage unconfined profiles as a bridge, the system allowed certain sequences of transitions to slip through without proper validation. This oversight means that an attacker who can influence or trigger these specific transition paths could manipulate the security context stack. By executing two sequential transitions involving an unconfined profile, the attacker can exploit the gap in logic where the confinement restrictions are not re-evaluated against the current state of the task's label stack.
The operational impact of this vulnerability is significant as it constitutes a privilege escalation or container escape vector depending on the deployment context. If exploited successfully, an entity that should be strictly confined by AppArmor policies could break out of its designated security domain. This undermines the fundamental promise of mandatory access control systems, which rely on strict isolation to limit the damage caused by compromised applications or services. In cloud environments or multi-tenant setups where user namespaces are frequently utilized for isolation, this flaw allows a malicious actor within one namespace to potentially gain unauthorized access to resources or contexts that should remain inaccessible. The ability to escape confinement can lead to further exploitation of host-level vulnerabilities, data exfiltration, or lateral movement across the system infrastructure.
This issue is categorized under CWE-284 Improper Access Control and aligns with ATT&CK techniques related to privilege escalation and defense evasion through container escapes. To mitigate this risk, it is essential to apply the kernel updates that address this specific logic error in AppArmor's label building process. The fix involves modifying the code so that checks against unconfined profiles are consistently enforced during every step of the stack construction for profile labels. This ensures that any attempt by a confined task to transition through an unconfined context is properly restricted, preventing the accumulation of states that could lead to confinement bypass. System administrators should prioritize patching their Linux kernels with versions containing this fix and verify that AppArmor profiles are correctly configured to minimize exposure to unprivileged transitions where possible. Regular auditing of security policies and monitoring for anomalous transition patterns can also help in detecting potential exploitation attempts before they result in a full compromise.