Linux Kernel EUVD-2026-81824

Requires local access to a task that is already AppArmor-confined by a profile stack, running on a kernel (approximately 6.7 through the fixed 6.18.52/7.2.6/7.3-rc1 range) with AppArmor enforcing. The specific trigger is the ability to execute two profile transitions through an unconfined profile; the unprivileged-transition restriction that should block escape via unconfined is not applied to the already-stacked task. Limiting factors: exploitation is local only (AV:L), needs an existing confined/stacked context (PR:L), depends on a policy configuration that permits transitions through unconfined, and only affects hosts that actually deploy AppArmor with these unprivileged-transition restrictions (primarily Ubuntu/SUSE). No user interaction is required.

This is a genuine security-boundary bypass, not a crash or DoS. The vendor CVSS3.1 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) describes an AppArmor confinement escape: a task already confined by a stack fails to have the unprivileged transition restriction on the 'unconfined' profile applied, so two transitions through an unconfined profile let the task escape its intended confinement. The scope change (S:C) is defensible because the flaw crosses the AppArmor policy boundary, and C:H/I:H reflect access to resources the policy was meant to deny - this typically serves as a stepping stone toward unprivileged-user-namespace-based privilege escalation. No exploitation signals are present: no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or opportunistic exploitation. This is a legitimate local hardening/priority fix for AppArmor-enforcing hosts (Ubuntu/SUSE), but it is not a mass-exploitable remote issue - it requires local access to an already-confined task and a policy configuration permitting the double transition through unconfined. Note the input Tags label this 'Information Disclosure,' which is a mislabel: the primary impact is an authorization/confinement bypass (CWE-863/284), and CWE is listed as N/A in the source data.

A local attacker running inside an AppArmor-confined task (e.g., a sandboxed application or container workload) whose policy is built on a stack executes two successive profile transitions through an unconfined component. Because the unprivileged-transition restriction on unconfined is not applied to an already-stacked task, the attacker escapes the intended AppArmor confinement - for instance bypassing the restriction that normally blocks unprivileged user-namespace creation - and gains access to resources or capabilities the policy was designed to deny. No public exploit code has been identified.