CVE-2026-46331 AppArmor Bypass via aa-exec for Unprivileged Userns on Ubuntu

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•4

Detects the suspicious combination of 'aa-exec' (commonly associated with AppArmor or specific container runtime wrappers) being followed by the execution of 'unshare' with flags used to manipulate kernel namespaces (user, network). This pattern is often indicative of container breakouts or privilege escalation attempts where an adversary leverages namespace isolation to gain higher privileges on the host.