Nine CrackArmor Flaws in Linux AppArmor Enable Root Escalation, Bypass Container Isolation

## Executive Summary Qualys TRU disclosed nine AppArmor 'confused deputy' vulnerabilities called "CrackArmor" affecting Linux kernels since 4.11 that allow unprivileged users to manipulate security profiles, bypass user-namespace restrictions, achieve local privilege escalation to root, subvert container isolation, perform denial-of-service, and leak KASLR. The flaws impact distributions that enable AppArmor by default (e.g., Ubuntu, Debian, SUSE); PoC exploits are being withheld and immediate kernel patching is recommended.