Ubuntu 26.04 users running kernel versions 7.0.0-41 and newer may face service disruptions due to a security patch related to CVE-2026-90231. The update, which enforces stricter AppArmor profile stacking, causes permission errors for containerized applications, particularly those using Go or standard Docker/Kubernetes profiles.
The issue stems from the kernel parameter kernel.apparmor_restrict_unprivileged_unconfined=1, which is enabled by default. When a container uses a standard AppArmor profile, the kernel applies a composite label that prevents processes from sending signals to one another. This leads to failures in services like PostgreSQL and causes Go-based binaries to enter a livelock state.
Engineers report that standard operations, such as sending signals to processes within a container, return 'Permission denied' errors even when UIDs match. Applications may hang, fail to start, or experience readiness probe failures. The problem is not a bug in the kernel itself but a behavioral change that the container ecosystem has not yet fully adapted to.
To mitigate the issue, administrators can update the containerd AppArmor profile to explicitly allow signals and ptrace for the composite labels. Other workarounds include disabling the AppArmor restriction or reverting to an older kernel version, though these methods reduce system security. Experts recommend treating kernel updates as major releases with rigorous testing.
