CVE-2026-46331 AppArmor Bypass via aa-exec for Unprivileged Userns on Ubuntu

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

Detects the use of AppArmor administrative and diagnostic tools (aa-exec, aa-status, apparmor_parser) with non-root accounts, or usage containing flags indicative of profile bypass attempts or privilege restriction probing.