The commit that introduces the stacked label is an upstream stable
patch, not an Ubuntu SAUCE change: in the 7.0.0-1015 changelog it comes
in with "upstream stable patchset 2026-10-05" (LP: #2169638) as the fix
for CVE-2026-90231 ("apparmor: fix unconfined user namespace restriction
forced stack"). Other distributions that take this stable patch are
likely to hit the same issue.I have reported it upstream as well: https://gitlab.com/apparmor/apparmor/-/issues/676 Possibly related upstream: https://gitlab.com/apparmor/apparmor/-/issues/668 (a blanket allow is lost once the label is stacked/mixed under the unprivileged_userns restriction). ** Bug watch added: gitlab.com/apparmor/apparmor/-/issues #676 https://gitlab.com/apparmor/apparmor/-/issues/676 ** Bug watch added: gitlab.com/apparmor/apparmor/-/issues #668 https://gitlab.com/apparmor/apparmor/-/issues/668 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90231 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172531 Title: linux-oracle 7.0.0-1015: AppArmor forced stack breaks signals between threads in containerd (k3s) containers; Go programs hang in setgid (gosu) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux-oracle/+bug/2172531/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
