# CVE-2026-23404: apparmor: replace recursive profile removal with iterative approach CVE-2026-23404 is fixed in 12 products on 1 platform, first by DEBIAN-CVE-2026-23404, released April 1, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-23404 - Priority: Routine - CVSS: 5.5 (Moderate) - EPSS: 0.0018 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 1, 2026 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23404 ## Description In the Linux kernel, the following vulnerability has been resolved: apparmor: replace recursive profile removal with iterative approach The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes. Reproducer: $ pf='a'; for ((i=0; i<1024; i++)); do echo -e "profile $pf { \n }" | apparmor_parser -K -a; pf="$pf//x"; done $ echo -n a > /sys/kernel/security/apparmor/.remove Replace the recursive __aa_profile_list_release() approach with an iterative approach in __remove_profile(). The function repeatedly finds and removes leaf profiles until the entire subtree is removed, maintaining the same removal semantic without recursion. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | kernel-64kb sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-azure sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-default sles 15.6 | 6.4.0-150600.23.112.1 | [SUSE-SU-2026:2195-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2195-1.md) | Jul 1, 2026 | | Linux | kernel-default sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-default-base sles 15.6 | 6.4.0-150600.23.112.1.150600.12.52.1 | [SUSE-SU-2026:2195-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2195-1.md) | Jul 1, 2026 | | Linux | kernel-default-base sles 15.7 | 6.4.0-150700.53.55.1.150700.17.33.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-docs sles 15.6 | 6.4.0-150600.23.112.1 | [SUSE-SU-2026:2195-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2195-1.md) | Jul 1, 2026 | | Linux | kernel-docs sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-livepatch-SLE15-SP6_Update_26 sles 15.6 | 1-150600.13.3.1 | [SUSE-SU-2026:2195-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2195-1.md) | Jul 1, 2026 | | Linux | kernel-livepatch-SLE15-SP7_Update_15 sles 15.7 | 1-150700.15.3.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-obs-build sles 15.6 | 6.4.0-150600.23.112.1 | [SUSE-SU-2026:2195-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2195-1.md) | Jul 1, 2026 | | Linux | kernel-obs-build sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-source sles 15.6 | 6.4.0-150600.23.112.1 | [SUSE-SU-2026:2195-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2195-1.md) | Jul 1, 2026 | | Linux | kernel-source sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-syms sles 15.6 | 6.4.0-150600.23.112.1 | [SUSE-SU-2026:2195-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2195-1.md) | Jul 1, 2026 | | Linux | kernel-syms sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-zfcpdump sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | linux Debian 12.15 (bookworm) | 6.1.164-1 | [DEBIAN-CVE-2026-23404](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23404.md) | Apr 1, 2026 | | Linux | linux Debian 13.5 (trixie) | 6.12.74-2 | [DEBIAN-CVE-2026-23404](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23404.md) | Apr 1, 2026 | | Linux | linux Debian 14 | 6.19.6-2 | [DEBIAN-CVE-2026-23404](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23404.md) | Apr 1, 2026 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.