9 AppArmor Kernel Bugs Hidden Since 2017 — Root Escalation, Container Escape, and 12.6M Linux Systems Exposed

Nine critical vulnerabilities in Linux AppArmor — collectively dubbed CrackArmor by the Qualys Threat Research Unit — let any unprivileged local user escalate to root, escape container isolation, and crash entire systems via kernel panic. These flaws have existed in every kernel since v4.11 (April 2017). If you run infrastructure on Ubuntu, Debian, or SUSE — and if you use Kubernetes, your nodes almost certainly do — this is a patch-now situation. Over 12.6 million enterprise Linux instances run with AppArmor enabled by default. Here's what broke, why it matters for your containers and infrastructure, and exactly how to check and fix it. The Attack Surface: What CrackArmor Actually Does CrackArmor exploits a confused deputy flaw in AppArmor's kernel implementation. AppArmor is the Mandatory Access Control (MAC) framework that confines processes under security profiles — it ships enabled by default on Ubuntu, Debian, and SUSE. The nine vulnerabilities let an attacker trick privileged pr