PT-2026-29488 · Linux+2 · Linux Kernel+2

Published 2026-04-01 · Updated 2026-05-11 · CVE-2026-23405

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw in apparmor where the number of policy namespaces is not bounded, potentially leading to resource exhaustion through arbitrary nesting. This issue is not strictly tied to user namespaces, allowing for the creation and nesting of policy namespaces to an unlimited depth.

Recommendations Limit the depth of policy namespaces to match the depth of user namespaces.

Fix

Related Identifiers

CVE-2026-23405

OESA-2026-1862

OESA-2026-1863

OESA-2026-1864

OESA-2026-1950

USN-8098-10

USN-8152-1

USN-8163-1

USN-8163-2

USN-8164-1

USN-8165-1

USN-8201-1

USN-8224-1

USN-8243-1

USN-8261-1

USN-8266-1

USN-8267-1

Affected Products

Linuxmint

Linux Kernel

Ubuntu

References · 921

• https://ubuntu.com/security/CVE-2025-71095 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68244 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68340 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38125 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40321 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40051 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68307 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68758 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23003 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68337 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68818 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40315 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-39829 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53194 · Security Note