CVE-2026-90231

HighCVSS 8.4/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix unconfined user namespace restriction forced stack

If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitions through an unconfined profile can be executed.

Fix this by pushing the check into the per profile label build. The check will always be done against unconfined and result in a stack of just the unconfined component when necessary.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 17, 2026
Last modified
Oct 21, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-90232In the Linux kernel, the following vulnerability has been resolved: amt: Don't support cross-netns setup. When a lower device is unregisteCVE-2026-90233In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node CVE-2026-902347.5In the Linux kernel, the following vulnerability has been resolved: NFS: Return a delegation the client fails to record When an NFS serverCVE-2026-902359.8In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITECVE-2026-90236In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4_putCVE-2026-902377.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: move custom expectation support to helper OriginallCVE-2026-90238In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error paCVE-2026-90239In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumemCVE-2026-90248.7A Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer from Release 3DEXPECVE-2026-902408.8In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliaCVE-2026-902418.2In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Tear down scalable-mode context on probe failure intel_pasCVE-2026-90242In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopf_refcount leak on RID domain replacement intel_iom
CVE-2026-90231: High severity, CVSS 8.4 | Vulnix