Back Blog.Qualys

CrackArmor: Critical AppArmor Flaws Enable Local Privilege Escalation to Root

Blog.Qualys • March 13, 2026

Security Context & Vulnerability Mechanism · Versions Affected by CrackArmor Vulnerabilities and Immediate Action Required · Understanding the Potential ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CrackArmor Vulnerabilities Risk Root Access in 12.6 Million Linux Systems Qualys researchers have identified nine critical vulnerabilities in AppArmor, a mandatory access control framework for Linux, collectively termed 'CrackArmor.' These flaws allow unprivileged local users to escalate privileges to root, bypass container isolation, and potentially crash kernel operations. The vulnerabilities affect over 12.6 million enterprise Linux systems globally, particularly those using distributions like Ubuntu, Debian, and SUSE. The vulnerabilities stem from how the Linux kernel manages AppArmor security profiles, enabling attackers to manipulate privileged processes through specific file interfaces. The issues have existed since Linux kernel version 4.11, released in 2017, and do not yet have assigned CVE identifiers. Immediate kernel updates are recommended as interim mitigations do not provide sufficient protection. Organizations are urged to follow distribution-specific advisories for remediation. The vulnerabilities pose significant risks to system integrity and security. 17 sources 72

CrackArmor: Critical AppArmor Flaws Enable Local Privilege Escalation to Root

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (1)