Researchers found nine “CrackArmor” flaws in Linux AppArmor that could let unprivileged users bypass protections, gain root privileges, and weaken container isolation.
Qualys researchers disclosed nine vulnerabilities, collectively tracked as CrackArmor, in the Linux kernel’s AppArmor module.
The flaws have existed since 2017 and could allow unprivileged users to bypass protections, escalate privileges to root, run code in the kernel, or cause denial-of-service conditions.
AppArmor is a Linux security module that protects the operating system and applications by enforcing strict behavior rules to block both known and unknown threats, including zero-day attacks. It adds mandatory access control to the traditional Unix discretionary access model and has been part of the Linux kernel since version 2.6.36, with development supported by Canonical since 2009.
Because AppArmor is widely deployed in enterprise systems, cloud platforms, containers, and IoT environments, the issue potentially affects more than 12.6 million Linux systems.
Researchers developed proof-of-concept exploits but did not release them publicly to reduce risk.
No CVE identifiers have been assigned yet, but security teams are strongly advised to patch the Linux kernel immediately, as updates are the only reliable way to mitigate the risk.
The CrackArmor flaws expose a confused-deputy issue that lets unprivileged users manipulate AppArmor security profiles, bypass namespace limits, and run code in the Linux kernel. Attackers could escalate privileges to root through interactions with tools like Sudo and Postfix, trigger denial-of-service attacks, and bypass Kernel Address Space Layout Randomization protections. The findings highlight serious weaknesses in default security assumptions and could impact system confidentiality, integrity, and availability.
“This “CrackArmor” advisory exposes a confused-deputy flaw allowing unprivileged users to manipulate security profiles via pseudo-files, bypass user-namespace restrictions, and execute arbitrary code within the kernel.” reads the report. “These flaws facilitate local privilege escalation to root through complex interactions with tools like Sudo and Postfix, alongside denial-of-service attacks via stack exhaustion and Kernel Address Space Layout Randomization (KASLR) bypasses via out-of-bounds reads. “
The CrackArmor flaws in AppArmor let unprivileged users trigger denial-of-service by loading “deny-all” profiles or removing nested subprofiles, causing kernel panics and forced reboots. With AppArmor enabled by default on Ubuntu, Debian, and SUSE, cloud, Kubernetes, and edge systems are at risk. These vulnerabilities could be exploited by state-sponsored hackers, making immediate kernel patching and monitoring critical.
The CrackArmor vulnerabilities exploit a design flaw in AppArmor, the Linux Mandatory Access Control framework included in the kernel since 2.6.36 and enabled by default in Ubuntu, Debian, SUSE, and derivatives. Unprivileged users can trick privileged processes like Sudo or Postfix into modifying AppArmor profiles via pseudo-files, bypassing namespace restrictions, executing arbitrary kernel code, collapsing container isolation, and escalating to root. The flaws impact all kernel versions since v4.11. Organizations must patch immediately, scan for exposure using Qualys QIDs, and monitor /sys/kernel/security/apparmor/ for profile changes. These flaws target the zero-trust foundations of enterprise, cloud, Kubernetes, and edge deployments, making rapid remediation critical.
“This is comparable to an intruder convincing a building manager with master keys to open restricted vaults that the intruder cannot enter alone. In this scenario, attackers leverage trusted tools like Sudo or Postfix to modify protected AppArmor profiles via pseudo-files (/sys/kernel/security/apparmor/.load, .replace).” continues the report. “This bypasses user-namespace restrictions and allows for arbitrary code execution within the kernel, collapsing container isolation and enabling local privilege escalation (LPE) to root.”
Organizations should patch immediately, use Qualys QIDs to scan for exposed systems, and monitor /sys/kernel/security/apparmor/ for unauthorized profile changes. Check vendor advisories for affected versions and fixes to secure enterprise, cloud, Kubernetes, and edge deployments.
“Immediate kernel patching remains the non-negotiable priority for neutralizing these critical vulnerabilities, as interim mitigation does not offer the same level of security assurance as restoring the vendor-fixed code path.” concludes the report.
For three decades, the Subaru Outback has occupied a unique corner of the automotive world, carving out a niche that sits comfortably between a family wagon and a mountain-climbing SUV. With over three million sold since its debut, the Outback has become the literal and figurative utility player of the Subaru lineup.
Now entering its seventh generation, the 2026 Outback arrives when the average new vehicle price is at an all-time high, yet Subaru has kept its starting MSRPs reasonable, even dropping them in some instances. If you’re cross-shopping the Outback against other mid-size crossovers, here are the six best things about the 2026 Subaru Outback.
6
Affordable
High-value MSRP relative to the national average
One of the most compelling arguments for the 2026 Outback is its value proposition. While the average price of a new vehicle is hovering around or above $50,000, the Outback starts significantly lower.
The entry-level Premium begins at $36,445 (including destination), a figure that undercuts many rivals while still including standard all-wheel drive and a comprehensive suite of tech and safety features. Even the feature-heavy Touring XT and Wilderness trims typically stay under that $50,000 national benchmark, making the Outback a financially savvy choice for families.
Here is a fast trim level breakdown. The starting MSRP figures include the $1,450 destination fee.
Base Trim Engine
2.5-liter four boxer
Base Trim Transmission
CVT
Base Trim Drivetrain
All-Wheel Drive
Premium
Starting MSRP: $36,445
Heated seats.
Black rear badging.
Cargo tonneau cover.
Leather-wrapped steering wheel
Power rear gate w/ automatic close.
Removable rear trailer hitch bumper cover.
18-inch aluminum-alloy wheels w/ dark gray finish.
An optional package for the Premium adds rain-sensing wipers, cloud-based navigation, a wireless smartphone charger, a heated steering wheel, and a moonroof for $2,270.
Limited
Starting MSRP: $43,165
Navigation.
Power moonroof.
Harman Kardon stereo.
Wireless smartphone charger.
Heated rear seats and steering wheel.
18-inch aluminum-alloy wheels w/ matte black finish.
Two optional packages are available for the Outback Wilderness. The first adds a moonroof, navigation, and a surround-view monitor for $2,045.
The second includes those, plus Nappa leather seats with copper stitching, ventilated front seats, a 12-way power-adjustable driver’s seat, and an eight-way power-adjustable passenger seat for an additional $4,090.
581-mile range, standard AWD, and updated safety features.
5
Two capable powertrain options
Standard Symmetrical AWD
Credit: Subaru
Two Boxer (i.e., horizontally opposed) engines are available for the 2026 Outback, depending on the trim level. Premium, Limited, and Touring feature a naturally aspirated 2.5-liter four-cylinder with 180 horsepower (5,800 rpm) and 178 lb-ft. of torque (4,800 rpm).
Limited XT, Touring XT, and Wilderness have a 2.4-liter turbocharged four-cylinder with 260 horsepower (5,600 rpm) and 277 lb-ft. of torque (2,000 to 4,800 rpm). Despite being a turbo engine with a higher power output, it does not require premium fuel.
The X-MODE system is also standard, which can be used on a muddy path, a gravel road, or during a snowstorm. X-MODE uses the same sensors as the Symmetrical All-Wheel Drive system, making additional adjustments to the Outback to ensure the best possible traction.
4
Significant tech leap with Snapdragon power
Owners can create individual profiles
Subaru has addressed the issue of infotainment lag, one of the biggest complaints from previous owners. The 2026 Outback features an all-new infotainment system, with navigation map swipe now up to three times faster, audio screen transitions up to six times faster, and overall scroll response up to two times faster. Notable updates and improvements include:
Optimized Display: A 12.1-inch higher-resolution touchscreen replaces the previous 11.6-inch unit. The screen reduces unwanted glare and light reflections by up to 80%.
Better Graphics: Powered by a Snapdragon 8 Automotive Processor, it features an octa-core architecture and an Adreno GPU.
More Memory: Approximately 2.5 times faster computing performance, with memory doubled from 4 GB to 8 GB and storage expanded from 64 GB to 128 GB.
Connectivity: Supports wireless Android Auto and Apple CarPlay, HD Radio, Bluetooth phone and audio streaming, Google Built-in services (Google Assistant/Maps), and automatic updates.
Personalization: Owners can create individual profiles and configure the 12.3-inch digital gauge cluster to highlight certain features and information. The 12.3-inch cluster is also new for the 2026 Outback.
While the overhauled infotainment system is a selling point, one current 2026 Outback owner has reported that Apple CarPlay functionality and the wireless charging pad don’t always work as intended.
Brand
AstroAI
Capacity
Up to 8 car tires (single charge)
This AstroAI mini tire inflator is perfect for keeping in your glove box when traveling. It’s portable and battery powered, meaning you don’t have to plug it in to use it. Plus, you’re able to set the exact tire pressure you want it to inflate to and it’ll automatically stop when it reaches that pressure.
3
Return of physical climate controls
Small things add up
Credit: Subaru
In a rare move that prioritizes driver ergonomics over minimalist trends, Subaru has brought back physical buttons and knobs for the climate control system. While the large 12.1-inch screen handles navigation and media, the often-used functions, like cabin temperature and fan speed, can now be adjusted by feel without taking your eyes off the road.
According to the J.D. Power 2025 U.S. Initial Quality Study, infotainment touchscreens are the study’s most problematic category, with consumers expressing a general dislike for what is sometimes described as “infotainment creep.” Subaru’s decision to have physical buttons for some of the most common vehicle functions is a small change that buyers are likely to appreciate.
Better than a generic tablet glued to the dashboard.
2
Advanced “hands-off” driving system
Using GPS and 3D maps
Every 2026 Outback is standard with Subaru’s EyeSight package, which includes active safety features such as haptic steering wheel alerts, automatic emergency steering, lane keep assist, blind-spot and rear cross-traffic warnings, and reverse automatic braking.
Also standard is a feature called Emergency Stop Assist, which will stop the 2026 Outback if the driver becomes unresponsive while using the adaptive cruise control. Once stopped, the Outback can activate the hazard lights, unlock the doors, and call 911.
The Touring and Touring XT are standard with Highway Hands-Free Assist. Using GPS data and 3D high-definition maps, the system can manage steering, braking, and lane changes on compatible highways with an attentive driver. Highway Hands-Free Assist does require an active MySubaru Companion or Companion+ subscription, which typically includes a five-year trial for 2026 models.
1
Genuine off-road capability
Plenty of ground clearance
Credit: Subaru
Unlike many “soft-roaders” that simply add plastic cladding, the 2026 Outback offers hardware that backs up its muscular look, especially with the Wilderness model.
Every Outback comes with at least 8.7 inches of clearance to begin with, but the Wilderness trim bumps that to 9.5 inches. Combine that with the all-terrain Bridgestone Dueler tires, electronically controlled dampers, all-weather floormats, and ladder-style roof rails, and the 2026 Outback Wilderness is the ideal weekend getaway vehicle.
Wilderness models also have a variation of X-MODE called Dual Mode, which includes specific settings for snow, dirt, and mud, along with hill descent control.
Red carpet treatment, even if you buy something used.
Charitable causes and factory warranty
While the 2026 Subaru Outback makes a strong case for itself through an optimized infotainment system and rugged hardware, the ownership experience extends beyond the driver’s seat. For many buyers, the appeal of a Subaru lies in the brand’s alignment with social and environmental causes.
A prime example is the Subaru Love-Encore program launched in partnership with Gifts for Good. The program invites new customers back to the Subaru dealer about two weeks after purchase to meet with a staff member who can answer any questions they have about their new Subaru.
At that time, customers can choose either a mission-aligned product or direct the gift’s value to charity. Each physical gift is an ethically sourced product that comes with a story card, so customers can read about the impact the gift selection has made. Customers also have the option to redeem the gift’s value towards a charitable cause.
Every 2026 Subaru Outback has a three-year/36,000-mile bumper-to-bumper warranty and a five-year/60,000-mile powertrain warranty.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
March 16, 2026
