Back Cybersecuritynews

Critical CrackArmor Vulnerabilities Expose 12.6 Million Linux Servers to Complete Root Takeover

Cybersecuritynews •Guru Baran • March 13, 2026

Nine critical vulnerabilities have been discovered in AppArmor, which is a widely used mandatory access control framework for Linux. These vulnerabilities, collectively referred to as “CrackArmor,” enable unprivileged local users to escalate their privileges to root, break container isolation, and cause kernel operations to crash. This issue affects over 12.6 million enterprise Linux systems worldwide. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CrackArmor Vulnerabilities Risk Root Access in 12.6 Million Linux Systems Qualys researchers have identified nine critical vulnerabilities in AppArmor, a mandatory access control framework for Linux, collectively termed 'CrackArmor.' These flaws allow unprivileged local users to escalate privileges to root, bypass container isolation, and potentially crash kernel operations. The vulnerabilities affect over 12.6 million enterprise Linux systems globally, particularly those using distributions like Ubuntu, Debian, and SUSE. The vulnerabilities stem from how the Linux kernel manages AppArmor security profiles, enabling attackers to manipulate privileged processes through specific file interfaces. The issues have existed since Linux kernel version 4.11, released in 2017, and do not yet have assigned CVE identifiers. Immediate kernel updates are recommended as interim mitigations do not provide sufficient protection. Organizations are urged to follow distribution-specific advisories for remediation. The vulnerabilities pose significant risks to system integrity and security. 17 sources 72

Critical CrackArmor Vulnerabilities Expose 12.6 Million Linux Servers to Complete Root Takeover

The full story

Extracted Entities

Platforms (1)

Vulnerabilities (1)