Nine CrackArmor Vulnerabilities in Linux AppArmor Expose 12.6 Million Servers to Root Takeover

Overview

The Qualys Threat Research Unit has disclosed nine vulnerabilities in AppArmor, the mandatory access control module that ships enabled by default on Ubuntu, Debian, and SUSE Linux distributions. Collectively dubbed CrackArmor, the flaws have existed in every Linux kernel since version 4.11, released in 2017, and affect an estimated 12.6 million enterprise Linux instances worldwide.

The vulnerabilities are classified as confused deputy problems, a category of privilege-escalation bug in which an unprivileged process tricks a privileged one into performing actions on its behalf. In this case, attackers can manipulate AppArmor’s own security profiles to gain root access, escape container boundaries, or crash the kernel outright.

What We Know

Qualys researcher Saeed Abbasi detailed the attack surface in a disclosure published on March 12. The nine flaws collectively allow an unprivileged local user to:

• Load, remove, or alter AppArmor security profiles by opening privileged pseudo-files under /sys/kernel/security/apparmor/ for writing. The kernel checks permissions only when data is actually written, not when the file descriptor is opened, creating a race condition that a carefully timed exploit can win.
• Bypass Ubuntu’s user namespace restrictions, which rely on AppArmor to prevent unprivileged users from creating namespaces with elevated capabilities. CrackArmor renders that defense ineffective, enabling fully capable user namespaces.
• Trigger denial-of-service conditions through recursive stack exhaustion on x86-64 systems, where the kernel stack is limited to roughly 16 kilobytes, and through a use-after-free bug in the aa_loaddata structure.
• Defeat Kernel Address Space Layout Randomization via out-of-bounds reads that leak kernel memory addresses, a prerequisite for many further exploitation techniques.
• Escape container isolation, undermining one of AppArmor’s primary deployment scenarios in cloud-native infrastructure.

Canonical has confirmed that every supported Ubuntu release is affected, from Trusty Tahr (14.04 LTS) through Questing Quokka (25.10), and is tracking the kernel-side issues under Launchpad Bug #2143853. The company has begun shipping kernel patches and recommends applying both userspace mitigations and kernel security updates via sudo apt update && sudo apt upgrade followed by a reboot.

As The Hacker News reported, no CVE identifiers have been assigned yet because the upstream kernel team is the sole authority for issuing them. Qualys has withheld proof-of-concept exploit code to give administrators time to patch.

What We Don’t Know

Several questions remain unanswered. Without assigned CVEs or CVSS scores, organizations relying on vulnerability scanners may struggle to prioritize remediation through their standard workflows. Qualys has not disclosed whether it has observed exploitation in the wild, and the company’s decision to withhold proof-of-concept code suggests practical attacks require nontrivial chaining of the nine individual flaws.

It is also unclear how quickly Debian, SUSE, and downstream distributions will ship their own patches. Canonical has moved quickly with Ubuntu fixes, but the broader Linux ecosystem’s response timeline remains open.

The interaction between CrackArmor and other security modules is another unknown. Canonical’s advisory noted that an unrelated sudo vulnerability can be chained with the AppArmor flaws to escalate privileges further, raising the question of whether additional chaining opportunities exist with other system utilities.

Analysis

CrackArmor is notable less for the severity of any single flaw than for what it reveals about the assumptions embedded in Linux security architecture. AppArmor is trusted as a security boundary by container runtimes, cloud platforms, and enterprise hardening guides. A nine-year window of exploitability in a component this foundational underscores the difficulty of auditing kernel security modules that accumulate complexity over time.

The fact that the pseudo-file permission model, which checks access at write time rather than at open time, went unquestioned for nearly a decade speaks to a broader pattern: security-critical interfaces in the kernel often receive less adversarial scrutiny than user-facing application code. Qualys’s Threat Research Unit has a track record of surfacing this class of bug, having previously disclosed similar confused deputy issues in Polkit and sudo.

For organizations running containerized workloads on Ubuntu or Debian, the practical risk is significant. Container escape via AppArmor profile manipulation directly threatens multi-tenant environments where isolation between workloads is a contractual guarantee. Administrators should treat kernel patching as urgent, particularly on systems where AppArmor enforces tenant boundaries.