Critical CrackArmor Vulnerabilities Expose 12.6 Million Linux Servers to Complete Root Takeover

Nine critical vulnerabilities have been discovered in AppArmor, which is a widely used mandatory access control framework for Linux. These vulnerabilities, collectively referred to as “CrackArmor,” enable unprivileged local users to escalate their privileges to root, break container isolation, and cause kernel operations to crash. This issue affects over 12.6 million enterprise Linux systems worldwide.

The CrackArmor vulnerabilities trace their origins to Linux kernel version 4.11, released in 2017, and have remained undetected in production environments for nearly nine years.

Discovered by the Qualys Threat Research Unit (TRU) and publicly disclosed on March 12, 2026, the flaws reside within AppArmor’s implementation as a Linux Security Module (LSM), not in its underlying security model.

AppArmor has been part of the mainline Linux kernel since version 2.6.36 and ships enabled by default on Ubuntu, Debian, and SUSE, making its attack surface exceptionally broad across enterprise data centers, Kubernetes clusters, IoT deployments, and cloud platforms.

Qualys CyberSecurity Asset Management data confirms the scale of exposure: more than 12.6 million enterprise Linux instances run AppArmor enabled by default, all potentially vulnerable until patched.

CrackArmor Vulnerabilities

At the core of CrackArmor is a confused deputy vulnerability, a class of flaw where an unprivileged actor tricks a privileged process into performing unauthorized actions on their behalf.

Attackers exploit this by writing to AppArmor’s pseudo-files located at /sys/kernel/security/apparmor/.load, .replace, and .remove, using trusted system tools like Sudo and Postfix as unwitting proxies.

Because these tools operate with elevated privileges, they bypass user-namespace restrictions that would normally block the attacker’s direct access, enabling arbitrary code execution within the kernel itself.

The attack chains enabled by CrackArmor are varied and severe:

• Policy Bypass: Unprivileged users can silently remove protections for critical system daemons such as rsyslogd and cupsd, or load deny-all profiles for sshd to block all SSH access.
• Local Privilege Escalation (LPE) to Root (User-space): By loading a profile that strips CAP_SETUID from sudo and manipulating the MAIL_CONFIG environment variable, an attacker forces sudo to invoke Postfix’s sendmail binary as root, yielding a full root shell.
• Kernel-space LPE: Exploiting a use-after-free vulnerability in the aa_loaddata function, attackers can reallocate freed kernel memory as a page table that maps /etc/passwd, directly overwriting the root password entry and gaining root access via su.
• Container and Namespace Breakout: By loading a “userns” profile targeting /usr/bin/time, unprivileged users can create fully-capable user namespaces, undermining Ubuntu’s previously deployed namespace restriction mitigations.
• Denial of Service via Stack Exhaustion: Profiles with deeply nested subprofiles (up to 1,024 levels) can exhaust the kernel’s 16 KB stack during recursive removal, triggering a kernel panic and forced system reboot.
• KASLR Bypass: Out-of-bounds reads within profile parsing leak kernel memory addresses, defeating Kernel Address Space Layout Randomization and opening the door to further exploitation chains.

As of publication, no CVE identifiers have been assigned to the CrackArmor vulnerabilities. Because the flaws exist in the upstream Linux kernel, only the upstream kernel team holds authority to issue CVE numbers, a process that typically takes one to two weeks after a fix stabilizes in a stable release. Security teams should not allow the absence of a CVE number to delay remediation response.

Qualys TRU has developed working proof-of-concept exploit code demonstrating the full attack chain. While the team has withheld public release to allow patch deployment to proceed, the technical mechanics of the flaws are sufficiently documented for independent validation by the broader security community.

Organizations running AppArmor-enabled Linux systems should take the following actions without delay:

• Apply all available vendor kernel and AppArmor security patches for Ubuntu, Debian, SUSE, and their derivatives immediately.
• Deploy Qualys QID 386714 to scan all Linux endpoints for affected AppArmor versions and prioritize internet-facing assets.
• Monitor /sys/kernel/security/apparmor/ for any unexpected profile changes, which may signal active exploitation.
• Use Qualys CyberSecurity Asset Management queries to enumerate all Ubuntu, Debian, and SUSE assets with AppArmor installed across on-premises and cloud environments.

Qualys has confirmed that its own products and platforms are not affected by the CrackArmor vulnerabilities.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.