Nine CrackArmor Flaws in Linux AppArmor Enable Root Escalation, Bypass Container Isolation

Back Feeds.Feedburner

Nine CrackArmor Flaws in Linux AppArmor Enable Root Escalation, Bypass Container Isolation

Feeds.Feedburner •[email protected] (The Hacker News) • March 13, 2026

Share: View original

A practical deep dive into securing AI agents against real-world attack paths beyond the model itself.

See exactly where your controls stand against today’s threats—automated, accurate, approachable.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CrackArmor Vulnerabilities Risk Root Access in 12.6 Million Linux Systems Qualys researchers have identified nine critical vulnerabilities in AppArmor, a mandatory access control framework for Linux, collectively termed 'CrackArmor.' These flaws allow unprivileged local users to escalate privileges to root, bypass container isolation, and potentially crash kernel operations. The vulnerabilities affect over 12.6 million enterprise Linux systems globally, particularly those using distributions like Ubuntu, Debian, and SUSE. The vulnerabilities stem from how the Linux kernel manages AppArmor security profiles, enabling attackers to manipulate privileged processes through specific file interfaces. The issues have existed since Linux kernel version 4.11, released in 2017, and do not yet have assigned CVE identifiers. Immediate kernel updates are recommended as interim mitigations do not provide sufficient protection. Organizations are urged to follow distribution-specific advisories for remediation. The vulnerabilities pose significant risks to system integrity and security. 17 sources 72

Extracted Entities

MITRE ATT&CK (1)

T1068 - Exploitation for Privilege Escalation

Platforms (2)

Vulnerabilities (1)